CVE-2014-1859: fedoraproject fedora Link Following
CVSS: 5.5v3.0MediumModified
AliasesGHSA-2fc2-6r4j-p65hPYSEC-2018-34
Published 08-01-2018Last modified 06-08-2024
Vulnerability summary
CVE-2014-1859 is a medium (CVSS 5.5) Link Following vulnerability in fedoraproject fedora. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.6% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.0 (NVD)EPSS score
0.47%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 08-01-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
CVSS metrics
5 scores · 3 sources · 3 versionsHigh 7.1Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Medium 5.5Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesAll 3 agree
- OSV · PypiEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.02 pp
From 0.45% on 21-09-2026
21-09-202621-10-2026
EPSS score0.47%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- python-numpy< 1:1.8.1~rc1-1
Fedoraproject1 product
- fedoraEOL19 | 20
Numpy1 product
- numpy≤ 1.8.0 | 1.8.1:rc1
PyPI1 product
- numpy< 0bb46c1448b0d3f5453d5182a17ea7ac5854ee15 | < 1.8.1
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0
5 vendors · 5 products
References
15 links- lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.htmlVendor AdvisoryX Refsource FEDORAIssue TrackingThird Party AdvisoryWEB
- github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15X Refsource CONFIRMPatchThird Party AdvisoryWEBFIX
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryWEB- github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rstX Refsource CONFIRMPatchThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2014/02/08/3Mailing ListX Refsource MLISTIssue TrackingPatchThird Party AdvisoryWEB
- lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.htmlVendor AdvisoryX Refsource FEDORAIssue TrackingThird Party AdvisoryWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/91317VDB EntryX Refsource XFIssue TrackingThird Party AdvisoryWEB
