Improper input validation in GNU Glibc

CVE-2014-7817

The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.006 (44.2th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References