{"id":"CVE-2014-2906","aliases":["DEBIAN-CVE-2014-2906","EUVD-2014-2929","GHSA-7848-7877-wpjg","MGASA-2014-0404","openSUSE-SU-2019:2177-1","openSUSE-SU-2019:2188-1","openSUSE-SU-2024:10348-1"],"status":"published","title":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary...","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00314,"percentile":0.245,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2014-10-09T14:06:16Z","modified":"2026-10-23T16:02:16Z","fixes":[{"ecosystem":"Debian:12","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"fish3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-lp150.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"fish3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-lp151.2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"fishshell","product":"fish"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/04/28/4","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://github.com/fish-shell/fish-shell/issues/1437","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/fish-shell/fish-shell/releases/tag/2.1.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2906"},{"url":"https://github.com/advisories/GHSA-7848-7877-wpjg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2906","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0404.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13984","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2014/09/28/8","tags":["web"]},{"url":"http://fishshell.com/release_notes.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132618.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW/#3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128601","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3856","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2W3QH6VXA2BZDXBQCFFTODXPYTUKYKPG/#2W3QH6VXA2BZDXBQCFFTODXPYTUKYKPG","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-2906","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","status":"published","published":"2020-01-28T15:35:01Z","modified":"2024-08-06T10:28:46.422Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2929","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","status":"published","published":"2020-01-28T15:35:01Z","modified":"2024-08-06T10:28:46Z","updated_at":"2026-11-03T01:57:12.660671Z"}],"ghsa":[{"id":"GHSA-7848-7877-wpjg","title":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary...","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","status":"published","published":"2022-05-17T19:57:21Z","modified":"2023-01-28T05:05:01Z","updated_at":"2026-11-02T14:44:17.062669Z"}],"nvd":[{"id":"CVE-2014-2906","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","status":"published","published":"2020-01-28T16:15:12.133Z","modified":"2026-06-17T00:07:20.83Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-2906","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","status":"published","published":"2020-01-28T16:15:12Z","modified":"2026-04-16T06:21:09.609451434Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-2906","description":"The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.","status":"published","published":"2020-01-28T16:15:12.133Z","modified":"2026-10-23T16:02:16.635321677Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0404","title":"Updated fish package fixes multiple security vulnerabilities","description":"Updated fish packages fix security vulnerability:\n\nfish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not\ncheck the credentials of processes communicating over the fishd universal\nvariable server UNIX domain socket. This allows a local attacker to \nelevate their privileges to those of a target user running fish, including \nroot (CVE-2014-2905).\n\nfish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates\ntemporary files in an insecure manner.\n\nVersions 1.23.0 to 2.1.0 (inclusive) execute code via `funced` from these\ntemporary files, allowing privilege escalation to those of any user \nrunning fish, including root (CVE-2014-3856).\n\nAdditionally, from at least version 1.16.0 to version 2.1.0 (inclusive),\nfish will read data using the psub function from these temporary files,\nmeaning that the input of commands used with the psub function is under \nthe control of the attacker (CVE-2014-2906).\n\nfish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict\nconnections to the Web-based configuration service (fish_config). This\nallows remote attackers to execute arbitrary code in the context of the \nuser running fish_config (CVE-2014-2914).\n\nThe service is generally only running for short periods of time. The use of\nthe fish_config tool is optional as other interfaces to fish configuration\nare available.\n\nThe fish package has been updated to version 2.1.1 to fix these issues.\n","status":"published","published":"2014-10-09T14:06:16Z","modified":"2026-04-16T06:23:53.375379526Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2019:2177-1","title":"Security update for fish3","description":"\nThis update supplies the 'fish3' package, complementary to the 'fish' package.\n  ","status":"published","published":"2019-09-24T10:13:43Z","modified":"2026-02-04T03:49:00.476446Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2188-1","title":"Security update for fish3","description":"\nThis update includes fish3 into the openSUSE Leap 15.1 distribution. \n  ","status":"published","published":"2019-09-25T10:20:36Z","modified":"2026-02-04T03:45:59.888691Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10348-1","title":"fish-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the fish-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:35.366742Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}