CVE-2014-0476

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

Metrics

CVSS 2.0 3.7/10AV:L/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-04775.0The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cCVE-2014-04784.0APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse pCVE-2014-04796.8reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compaCVE-2014-04805.8The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 dCVE-2014-04814.3The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 beforCVE-2014-04826.0The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before CVE-2014-04833.5The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidaCVE-2014-04847.2The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."CVE-2014-04857.5S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialCVE-2014-04867.5Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.CVE-2014-04877.5APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspCVE-2014-04886.8APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attac
CVE-2014-0476: Low severity, CVSS 3.7 | Vulnix