MGASA-2014-0496

    Dashboard / Vulnerabilities / MGASA-2014-0496

    MGASA-2014-0496

    Published: 26 Nov 2014Last Modified: 16 Apr 2026
    Upstream:
    CVE-2014-7817

    Summary: Updated glibc packages fix CVE-2014-7817

    Details: The function wordexp() fails to properly handle the WRDE_NOCMD flag when processing arithmetic inputs in the form of "$((... ``))" where "..." can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDE_NOCMD forbade command substitution. This allows an attacker to attempt to pass dangerous commands via constructs of the above form, and bypass the WRDE_NOCMD flag. This update fixes the issue (CVE-2014-7817).

    References: https://advisories.mageia.org/MGASA-2014-0496.html, https://bugs.mageia.org/show_bug.cgi?id=14651, https://bugzilla.redhat.com/show_bug.cgi?id=1157689

    Affected packages

    Package

    Name: glibc

    Purl: pkg:rpm/mageia/glibc?arch=source&distro=mageia-3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.17-7.6.mga3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High