VulnerabilityModified

CVE-2014-8169

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via…

MEDIUM 4.4EPSS 0.34%

Does this matter?

Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.4 MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
EPSS: 0.34% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux server · redhat/enterprise linux workstation · automount project/automount · opensuse/opensuse
Source: secalert@redhat.com

References

http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1344.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73211
http://www.ubuntu.com/usn/USN-2579-1
https://bugzilla.redhat.com/show_bug.cgi?id=1192565Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=917977Issue Tracking
http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1344.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73211
http://www.ubuntu.com/usn/USN-2579-1
https://bugzilla.redhat.com/show_bug.cgi?id=1192565Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=917977Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.