{"id":"CVE-2014-3856","aliases":["DEBIAN-CVE-2014-3856","EUVD-2014-3793","GHSA-mh78-c455-hh2q","MGASA-2014-0404","openSUSE-SU-2019:2177-1","openSUSE-SU-2019:2188-1","openSUSE-SU-2024:10348-1"],"status":"published","title":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create...","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0029,"percentile":0.21717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2014-10-09T14:06:16Z","modified":"2026-10-23T16:01:31Z","fixes":[{"ecosystem":"Debian:12","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fish","fixed_in":["2.1.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"fish3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-lp150.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"fish3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0-lp151.2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"fishshell","product":"fish"}],"references":[{"url":"https://github.com/fish-shell/fish-shell/issues/1437","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/fish-shell/fish-shell/releases/tag/2.1.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2014/04/28/4","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3856"},{"url":"https://github.com/advisories/GHSA-mh78-c455-hh2q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3856","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0404.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13984","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2014/09/28/8","tags":["web"]},{"url":"http://fishshell.com/release_notes.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132618.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW/#3XMUPRUMZVMHTIGMFKMR5QUFUP4OTEOW","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128601","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3856","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2W3QH6VXA2BZDXBQCFFTODXPYTUKYKPG/#2W3QH6VXA2BZDXBQCFFTODXPYTUKYKPG","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-3856","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","status":"published","published":"2020-01-28T15:30:30Z","modified":"2024-08-06T10:57:17.381Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3793","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","status":"published","published":"2020-01-28T15:30:30Z","modified":"2024-08-06T10:57:17Z","updated_at":"2026-11-03T01:57:09.370988Z"}],"ghsa":[{"id":"GHSA-mh78-c455-hh2q","title":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create...","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","status":"published","published":"2022-05-17T19:57:21Z","modified":"2023-01-28T05:04:40Z","updated_at":"2026-11-02T14:44:13.169568Z"}],"nvd":[{"id":"CVE-2014-3856","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","status":"published","published":"2020-01-28T16:15:12.383Z","modified":"2026-06-17T00:09:02.017Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-3856","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","status":"published","published":"2020-01-28T16:15:12Z","modified":"2026-04-16T06:15:32.145620773Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3856","description":"The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.","status":"published","published":"2020-01-28T16:15:12.383Z","modified":"2026-10-23T16:01:31.191553154Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0404","title":"Updated fish package fixes multiple security vulnerabilities","description":"Updated fish packages fix security vulnerability:\n\nfish, from at least version 1.16.0 to version 2.1.0 (inclusive), does not\ncheck the credentials of processes communicating over the fishd universal\nvariable server UNIX domain socket. This allows a local attacker to \nelevate their privileges to those of a target user running fish, including \nroot (CVE-2014-2905).\n\nfish, from at least version 1.16.0 to version 2.1.0 (inclusive), creates\ntemporary files in an insecure manner.\n\nVersions 1.23.0 to 2.1.0 (inclusive) execute code via `funced` from these\ntemporary files, allowing privilege escalation to those of any user \nrunning fish, including root (CVE-2014-3856).\n\nAdditionally, from at least version 1.16.0 to version 2.1.0 (inclusive),\nfish will read data using the psub function from these temporary files,\nmeaning that the input of commands used with the psub function is under \nthe control of the attacker (CVE-2014-2906).\n\nfish, from version 2.0.0 to version 2.1.0 (inclusive), fails to restrict\nconnections to the Web-based configuration service (fish_config). This\nallows remote attackers to execute arbitrary code in the context of the \nuser running fish_config (CVE-2014-2914).\n\nThe service is generally only running for short periods of time. The use of\nthe fish_config tool is optional as other interfaces to fish configuration\nare available.\n\nThe fish package has been updated to version 2.1.1 to fix these issues.\n","status":"published","published":"2014-10-09T14:06:16Z","modified":"2026-04-16T06:23:53.375379526Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2019:2177-1","title":"Security update for fish3","description":"\nThis update supplies the 'fish3' package, complementary to the 'fish' package.\n  ","status":"published","published":"2019-09-24T10:13:43Z","modified":"2026-02-04T03:49:00.476446Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2188-1","title":"Security update for fish3","description":"\nThis update includes fish3 into the openSUSE Leap 15.1 distribution. \n  ","status":"published","published":"2019-09-25T10:20:36Z","modified":"2026-02-04T03:45:59.888691Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10348-1","title":"fish-2.4.0-1.1 on GA media","description":"These are all security issues fixed in the fish-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:35.366742Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}