What is CVE-2014-4677?

CVE-2014-4677 is a high-severity vulnerability in Gpgtools Libmacgpg, classified under Command Injection. CVSS score: 7.8/10. Published 2017-02-22.

How severe is CVE-2014-4677?

High severity. CVSS v3 base score is 7.8 out of 10.

RCE in Gpgtools Libmacgpg

CVE-2014-4677

The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.006 (47.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Gpgtools Libmacgpg
N/a — versions n/a

Weakness classification (CWE)

CWE-77 — Command Injection

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2014-4677?: CVE-2014-4677 is a high-severity vulnerability in Gpgtools Libmacgpg, classified under Command Injection. CVSS score: 7.8/10. Published 2017-02-22.
How severe is CVE-2014-4677?: High severity. CVSS v3 base score is 7.8 out of 10.