CVE-2014-4677

EUVD-2014-4597
The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before 2015.06 allows local users to execute arbitrary commands with root privileges via shell metacharacters in the xmlPath argument.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
gpgtoolslibmacgpg
𝑥
≤ 0.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://bierbaumer.net/security/cve-2014-4677/
https://gpgtools.org/releases/gpgsuite/2015.08/release-notes.html
https://bierbaumer.net/security/cve-2014-4677/
https://gpgtools.org/releases/gpgsuite/2015.08/release-notes.html