CVE-2014-5008: debian debian_linux Command Injection

CVSS: 9.8v3.0CriticalModified

AliasesUBUNTU-CVE-2014-5008DEBIAN-CVE-2014-5008

Published 31-03-2017Last modified 06-08-2024

Vulnerability summary

CVE-2014-5008 is a critical (CVSS 9.8) Command Injection vulnerability in debian debian_linux. EPSS estimates a 4.13% chance of exploitation in the next 30 days, higher than 90.7% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

4.13%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6

DLA-357-1 DSA-3248-1 RHSA-2017:0211 RHSA-2017:0212 RHSA-2017:0213 RHSA-2017:0214

Timeline

31-03-2017
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Snoopy allows remote attackers to execute arbitrary commands.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

4.13%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.13% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.13%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected systems

Debian2 products

libphp-snoopy< 2.0.0-1
debian_linuxEOL7.0

Redhat1 product

openstack5.0 | 6.0

Snoopy1 product

snoopyna

Ubuntu1 product

libphp-snoopy< 2.0.0-1

4 vendors · 5 products

References

16 links

www.securityfocus.com/bid/68419VDB EntryX Refsource BIDThird Party Advisory
www.openwall.com/lists/oss-security/2014/07/18/2Mailing ListX Refsource MLISTPatchThird Party Advisory
www.debian.org/security/2015/dsa-3248Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.openwall.com/lists/oss-security/2014/07/16/10Mailing ListX Refsource MLISTPatchThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=isg3T1024264X Refsource MISCThird Party Advisory
rhn.redhat.com/errata/RHSA-2017-0212.htmlVendor AdvisoryX Refsource REDHATPatchThird Party Advisory
rhn.redhat.com/errata/RHSA-2017-0213.htmlVendor AdvisoryX Refsource REDHATPatchThird Party Advisory
www.openwall.com/lists/oss-security/2016/12/21/8Mailing ListX Refsource MLISTPatchThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1121497X Refsource CONFIRMIssue TrackingPatch
rhn.redhat.com/errata/RHSA-2017-0214.htmlVendor AdvisoryX Refsource REDHATPatchThird Party Advisory

Show all 16 references

rhn.redhat.com/errata/RHSA-2017-0211.htmlVendor AdvisoryX Refsource REDHATPatchThird Party Advisory
snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=logX Refsource CONFIRMPatchThird Party Advisory
ubuntu.com/security/CVE-2014-5008REPORT
mstrokin.com/sec/…REPORT
www.cve.org/CVERecord?id=CVE-2014-5008REPORT
security-tracker.debian.org/tracker/CVE-2014-5008Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities