Описание
Security update for fish3
This update supplies the 'fish3' package, complementary to the 'fish' package.
Список пакетов
openSUSE Leap 15.0
Ссылки
- E-Mail link for openSUSE-SU-2019:2177-1
- SUSE Security Ratings
- SUSE Bug 1128601
- SUSE CVE CVE-2014-2905 page
- SUSE CVE CVE-2014-2906 page
- SUSE CVE CVE-2014-2914 page
- SUSE CVE CVE-2014-3219 page
- SUSE CVE CVE-2014-3856 page
Описание
fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.
Затронутые продукты
Ссылки
- CVE-2014-2905
Описание
The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.
Затронутые продукты
Ссылки
- CVE-2014-2906
Описание
fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.
Затронутые продукты
Ссылки
- CVE-2014-2914
Описание
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
Затронутые продукты
Ссылки
- CVE-2014-3219
Описание
The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.
Затронутые продукты
Ссылки
- CVE-2014-3856