CVE-2014-7844 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Redhat	Enterprise Linux Desktop	6.0
Redhat	Enterprise Linux Server	6.0
Redhat	Enterprise Linux Server Aus	6.6
Redhat	Enterprise Linux Server Eus	6.6
Redhat	Enterprise Linux Server Tus	6.6
Redhat	Enterprise Linux Workstation	6.0
Debian	Debian Linux	7.0
Bsd Mailx Project	Bsd Mailx	8.1.2

Related Weaknesses (CWE)

CWE-74

References

http://linux.oracle.com/errata/ELSA-2014-1999.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1999.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q4/1066Mailing ListPatchThird Party Advisory
http://www.debian.org/security/2014/dsa-3104Third Party Advisory
http://www.debian.org/security/2014/dsa-3105Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1999.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1999.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q4/1066Mailing ListPatchThird Party Advisory
http://www.debian.org/security/2014/dsa-3104Third Party Advisory
http://www.debian.org/security/2014/dsa-3105Third Party Advisory

FAQ

What is CVE-2014-7844?

CVE-2014-7844 is a vulnerability with a CVSS score of 7.8 (HIGH). BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.

How severe is CVE-2014-7844?

CVE-2014-7844 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-7844?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Server Tus.