CVE-2014-7817
EPSS 0.16%
Description
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
How to fix CVE-2014-7817
To remediate CVE-2014-7817, upgrade the affected package to a fixed version below.
- Debian/glibc—upgrade to 2.19-14 or later
Is CVE-2014-7817 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2.19-14