CVE-2014-3219

Published: Feb 9, 2018Modified: Nov 21, 2024

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.

Affected (2)

Products: Fishshell: Fish · Fedoraproject: Fedora

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Fishshell Fish	Before 2.1.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 19

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (20)

http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132751.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00059.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00071.html

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-201412-49.xml

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2014/05/06/3

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/09/28/8

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/67115

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1092091

Source: cve@mitre.org

Issue TrackingPatchThird Party AdvisoryVDB Entry

https://github.com/fish-shell/fish-shell/commit/3225d7e169a9edb2f470c26989e7bc8e0d0355ce

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/fish-shell/fish-shell/issues/1440

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132751.html