CVE-2014-2905 Privilege escalation in n/a

Medium 6.9 Published 2 May 2014 Updated 6 Aug 2024

Local attackers can escalate privileges by exploiting insecure permissions on the fish shell universal variable socket.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-2905?

CVE-2014-2905 is a medium-severity vulnerability in n/a, published on 2 May 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.

Weakness: CWE-264

Which versions are affected by CVE-2014-2905?

It affects 1 product.

Products include Fishshell Fish.

How do I fix CVE-2014-2905?

Upgrade to a fixed version.

Is CVE-2014-2905 being exploited?

There is no known exploitation of CVE-2014-2905 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2014-2905, GHSA-v858-38cm-f567.