Main Vulnerability Database Vulnerabilities #VU33087

Permissions, Privileges, and Access Controls - CVE-2014-8991

Published: November 24, 2014 / Updated: August 3, 2020

Vulnerability identifier: #VU33087

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-8991

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to perform service disruption.

pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.

Affected software

py-pip (Alpine package)
privoxy (Alpine package)

How to mitigate CVE-2014-8991

Install update from vendor's website.

py-pip (Alpine package) - update to 1.5.6-r2
privoxy (Alpine package) - update to 3.0.23-r0

External References

Related Security Bulletins