fish: Multiple vulnerabilities — GLSA 201412-49

Multiple vulnerabilities have been found in fish, the worst of which could result in local privilege escalation or remote arbitrary code execution.

Affected packages

Background

fish is the Friendly Interactive SHell.

Description

Multiple vulnerabilities have been discovered in fish. Please review the CVE identifiers referenced below for details.

Impact

A local attacker may be able to gain escalated privileges or overwrite arbitrary files. Furthermore, a remote attacker may be able to execute arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-shells/fish-2.1.1"
 

References

• CVE-2014-2905
• CVE-2014-2906
• CVE-2014-2914
• CVE-2014-3219

Release date
December 28, 2014

Latest revision
December 28, 2014: 1

Severity
high

Exploitable
local, remote

Bugzilla entries

• 509044