CVE-2014-2905

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.35%

Published

May 2, 2014

Modified

May 6, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.

Weaknesses (CWE)

CWE-264

Affected Products (2)

fishshell · fishvulnerable

References (8)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00071.html

http://www.openwall.com/lists/oss-security/2014/04/28/4

https://github.com/fish-shell/fish-shell/issues/1436

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00071.html

http://www.openwall.com/lists/oss-security/2014/04/28/4

https://github.com/fish-shell/fish-shell/issues/1436

KEV Catalog EPSS Scores Vendors All CVEs