Unscored severity · published Jan 6, 2015
CVE-2014-7209
run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename
–
CVSS
2.8%
EPSS
No
On KEV
Description
run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Mime-support · Debian
through 3.52-1 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7209
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7209
secunia.com
http://secunia.com/advisories/61892
secunia.com
http://secunia.com/advisories/62079
Vendor Advisory
http://www.debian.org/security/2014/dsa-3114
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/12/31/8
www.securityfocus.com
http://www.securityfocus.com/bid/71797
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/99570
More from Mime-support
–
CVE-2003-0214
run-mailcap in mime-support 3.22 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files