Unscored severity · published Jan 14, 2010
CVE-2010-0002
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows…
–
CVSS
0.7%
EPSS
No
On KEV
Description
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Bash · Gnu
2.05; 3.0; 3.2; 3.2.48; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0002
Patch
http://www.mandriva.com/security/advisories?name=MDVSA-2010:004
qa.mandriva.com
https://qa.mandriva.com/show_bug.cgi?id=56882
More from Bash
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
8.4
CVE-2016-7543
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables
7.8
CVE-2022-3715
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform