CVE-2014-2906: Race Condition
The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2014-2906.
What is the severity of CVE-2014-2906?
The severity of CVE-2014-2906 is high with a severity value of 7.
What is the affected software for CVE-2014-2906?
The affected software for CVE-2014-2906 includes fish (aka fish-shell) versions 1.16.0 before 2.1.1.
How can local users exploit CVE-2014-2906?
Local users can exploit CVE-2014-2906 by executing arbitrary commands via a temporary file with a predictable name.
Where can I find more information about CVE-2014-2906?
You can find more information about CVE-2014-2906 at the following references: [GitHub Issue](https://github.com/fish-shell/fish-shell/issues/1437), [Debian Security Tracker](https://security-tracker.debian.org/tracker/CVE-2014-2906), [Openwall Mailing List](http://www.openwall.com/lists/oss-security/2014/04/28/4).