Vulnerability in Nongnu Gksu
CVE-2014-2886
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during installation of a VirtualBox extension pack.
EPSS: 0.022 (80.6th percentile) — read the EPSS interpretation.
Affected products
- Nongnu Gksu — versions 2.0.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vendor-advisory, x_refsource_GENTOO)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)
Frequently asked questions
- What is CVE-2014-2886?
- CVE-2014-2886 is a vulnerability in Nongnu Gksu, classified under CWE-264. Published 2014-09-18.
- Is CVE-2014-2886 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.