CVE-2014-7817: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2014-7817 is a medium (CVSS 4.6) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.6% of scored vulnerabilities.
Not severe (CVSS 4.6, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 24-11-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.58% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat9 products
- glibc< 0:2.17-55.el7_0.3
- glibc-common< 0:2.17-55.el7_0.3
- glibc-debuginfo< 0:2.17-55.el7_0.3
- glibc-debuginfo-common< 0:2.17-55.el7_0.3
- glibc-devel< 0:2.17-55.el7_0.3
Debian2 products
- glibc< 2.19-14
- debian_linuxEOL7.0
Mageia2 products
- glibc< 2.17-7.6.mga3
- glibc< 2.18-9.5.mga4
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10
Gnu1 product
- glibc2.21
Opensuse1 product
- opensuseEOL13.1 | 13.2
Ubuntu1 product
- eglibc< 2.19-0ubuntu6.4
7 vendors · 17 products
References
30 links- www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlX Refsource CONFIRM
- linux.oracle.com/errata/ELSA-2015-0016.htmlX Refsource CONFIRM
- sourceware.org/ml/libc-alpha/2014-11/msg00519.htmlMailing ListX Refsource MLISTVendor AdvisoryREPORT
- sourceware.org/git/…X Refsource CONFIRM
Show all 30 references
- www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlX Refsource CONFIRM
- sourceware.org/bugzilla/show_bug.cgi?id=17625X Refsource CONFIRM
