{"id":"CVE-2014-2914","aliases":["DEBIAN-CVE-2014-2914","EUVD-2014-2937","GHSA-7wvh-j87j-478f","MGASA-2014-0404","openSUSE-SU-2019:2177-1","openSUSE-SU-2019:2188-1","openSUSE-SU-2024:10348-1"],"status":"published","title":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service ...","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0319,"percentile":0.88184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-10-09T14:06:16Z","modified":"2026-10-23T16:02:16Z","fixes":[{"ecosystem":"Debian:12","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"fish3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-lp150.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"fish3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-lp151.2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"fishshell","product":"fish"}],"references":[{"url":"https://github.com/fish-shell/fish-shell/issues/1438","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/04/28/4","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2914"},{"url":"https://github.com/advisories/GHSA-7wvh-j87j-478f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2914","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0404.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13984","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2014/09/28/8","tags":["web"]},{"url":"http://fishshell.com/release_notes.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132618.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW/#3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128601","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3856","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2W3QH6VXA2BZDXBQCFFTODXPYTUKYKPG/#2W3QH6VXA2BZDXBQCFFTODXPYTUKYKPG","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-2914","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","status":"published","published":"2020-01-28T15:21:21Z","modified":"2024-08-06T10:28:46.205Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2937","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","status":"published","published":"2020-01-28T15:21:21Z","modified":"2024-08-06T10:28:46Z","updated_at":"2026-11-03T01:57:12.660671Z"}],"ghsa":[{"id":"GHSA-7wvh-j87j-478f","title":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service ...","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","status":"published","published":"2022-05-17T19:57:21Z","modified":"2023-01-28T05:04:39Z","updated_at":"2026-11-02T14:44:13.169568Z"}],"nvd":[{"id":"CVE-2014-2914","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","status":"published","published":"2020-01-28T16:15:12.197Z","modified":"2026-06-17T00:07:21.407Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-2914","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","status":"published","published":"2020-01-28T16:15:12Z","modified":"2026-04-16T06:20:47.86761725Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-2914","description":"fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.","status":"published","published":"2020-01-28T16:15:12.197Z","modified":"2026-10-23T16:02:16.704442452Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0404","title":"Updated fish package fixes multiple security vulnerabilities","description":"Updated fish packages fix security vulnerability:\n\nfish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not\ncheck the credentials of processes communicating over the fishd universal\nvariable server UNIX domain socket. This allows a local attacker to \nelevate their privileges to those of a target user running fish, including \nroot (CVE-2014-2905).\n\nfish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates\ntemporary files in an insecure manner.\n\nVersions 1.23.0 to 2.1.0 (inclusive) execute code via `funced` from these\ntemporary files, allowing privilege escalation to those of any user \nrunning fish, including root (CVE-2014-3856).\n\nAdditionally, from at least version 1.16.0 to version 2.1.0 (inclusive),\nfish will read data using the psub function from these temporary files,\nmeaning that the input of commands used with the psub function is under \nthe control of the attacker (CVE-2014-2906).\n\nfish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict\nconnections to the Web-based configuration service (fish_config). This\nallows remote attackers to execute arbitrary code in the context of the \nuser running fish_config (CVE-2014-2914).\n\nThe service is generally only running for short periods of time. The use of\nthe fish_config tool is optional as other interfaces to fish configuration\nare available.\n\nThe fish package has been updated to version 2.1.1 to fix these issues.\n","status":"published","published":"2014-10-09T14:06:16Z","modified":"2026-04-16T06:23:53.375379526Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2019:2177-1","title":"Security update for fish3","description":"\nThis update supplies the 'fish3' package, complementary to the 'fish' package.\n  ","status":"published","published":"2019-09-24T10:13:43Z","modified":"2026-02-04T03:49:00.476446Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2188-1","title":"Security update for fish3","description":"\nThis update includes fish3 into the openSUSE Leap 15.1 distribution. \n  ","status":"published","published":"2019-09-25T10:20:36Z","modified":"2026-02-04T03:45:59.888691Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10348-1","title":"fish-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the fish-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:35.366742Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}