CVE-2014-2914

fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fishconfig), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by setprompt.

References

Affected packages

Debian:11 / fish

Package

Name: fish
Purl: pkg:deb/debian/fish?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / fish

Package

Name: fish
Purl: pkg:deb/debian/fish?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / fish

Package

Name: fish
Purl: pkg:deb/debian/fish?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}