High severity · published Apr 27, 2018
CVE-2014-1845
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Enlightenment · Enlightenment
before 0.17.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1845
Mailing List
http://www.openwall.com/lists/oss-security/2014/02/03/19
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1059410
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91216
Patch
https://git.enlightenment.org/core/enlightenment.git/commit/?id=666df815cd86a50343859bce36c5cf968c5f38b0
Patch
https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b
More from Enlightenment
7.8
CVE-2022-37706
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin…
7.8
CVE-2014-1846
Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method