CVE-2014-2905

fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.

References

Affected packages

Debian:11 / fish

Package

Name: fish
Purl: pkg:deb/debian/fish?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / fish

Package

Name: fish
Purl: pkg:deb/debian/fish?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / fish

Package

Name: fish
Purl: pkg:deb/debian/fish?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1-1

Ecosystem specific

{
    "urgency": "low"
}