CVE-2014-2096

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain...

4.6 MediumFix available

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Exploit likelihood

0.42%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.6

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: CVE-2014-2096
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: CVE-2014-2096
Updated: 2026-11-02

EUVDEUVD-2014-2136 No score

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: EUVD-2014-2136
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xf4h-5cm9-5xfc No score

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain...

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: GHSA-xf4h-5cm9-5xfc
Updated: 2026-11-02

OSV No score

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: CVE-2014-2096
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-2096 No score

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: DEBIAN-CVE-2014-2096
Updated: 2026-11-02

OSVMGASA-2014-0342 No score

Updated catfish package fixes CVE-2014-2096

Updated catfish package fixes security vulnerabilities:

Untrusted search path vulnerability in Catfish allows local users to gain privileges via a Trojan horse bin/catfish.py in the current working directory (CVE-2014-2096).

Additionally, the update adds a missing requirement for the gnome-icon-theme-symbolic package.

Record: MGASA-2014-0342
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-2096 No score

Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.

Record: UBUNTU-CVE-2014-2096
Updated: 2026-11-02

Affected products

catfish project catfish

Affected packages

Affected packages
Package	Affected	Fixed
`catfish` Debian:12	before 1.0.1-1	1.0.1-1
`catfish` Debian:13	before 1.0.1-1	1.0.1-1
`catfish` Debian:14	before 1.0.1-1	1.0.1-1
`catfish` Mageia:4	before 0.8.2-2.1.mga4	0.8.2-2.1.mga4
`catfish` Ubuntu:14.04:LTS	before 1.0.1-1, plus listed versions 0.8.2-0ubuntu10.8.2-11.0.0-11.0.0-21.0.0-3	1.0.1-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-2096 is a medium vulnerability (CVSS 4.6) in Catfish Project Catfish, published February 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in catfish 1.0.1-1.

References

Show 6 moreShow less