CVE-2014-3856: Race Condition
Published Jan 28, 2020
·Updated
The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.
Affected Software
2 affected componentsFixes available
debian/fish
3.1.2-3+deb11u13.6.0-3.1+deb12u13.7.1-1
Fishshell Fish>=1.23.0<2.1.1
Event History
Jan 28, 2020
CVE Published
via MITRE·03:30 PM
Data Sourced
via MITRE·03:30 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3856?
The severity of CVE-2014-3856 is high with a severity value of 7.
2
How does CVE-2014-3856 affect fish (aka fish-shell)?
CVE-2014-3856 affects fish (aka fish-shell) versions 1.23.0 before 2.1.1.
3
How can local users gain privileges with CVE-2014-3856?
Local users can gain privileges by exploiting CVE-2014-3856 through a temporary file with a predictable name.
4
Which software versions are affected by CVE-2014-3856?
Versions 1.23.0 before 2.1.1 of fish (aka fish-shell) are affected by CVE-2014-3856.
5
How can I fix CVE-2014-3856?
To fix CVE-2014-3856, it is recommended to update fish (aka fish-shell) to version 2.1.1 or higher.