CVE-2014-8169

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

• CWE-264

• http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1344.htmlThird Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/73211
• http://www.ubuntu.com/usn/USN-2579-1
• https://bugzilla.redhat.com/show_bug.cgi?id=1192565Issue Tracking
• https://bugzilla.suse.com/show_bug.cgi?id=917977Issue Tracking
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1344.htmlThird Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/73211
• http://www.ubuntu.com/usn/USN-2579-1
• https://bugzilla.redhat.com/show_bug.cgi?id=1192565Issue Tracking
• https://bugzilla.suse.com/show_bug.cgi?id=917977Issue Tracking

Published

Mar 18, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-8163Directory traversal vulnerability in the XMLRPC interface in…
• CVE-2014-8164A insecure configuration for certificate verification (http.…9.1
• CVE-2014-8165scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python …
• CVE-2014-8166The browsing feature in the server in CUPS does not filter A…8.8
• CVE-2014-8167vdsm and vdsclient does not validate certficate hostname fro…5.9
• CVE-2014-8168Red Hat Satellite 6 allows local users to access mongod and …
• CVE-2014-8170ovirt_safe_delete_config in ovirtfunctions.py and other unsp…
• CVE-2014-8171The memory resource controller (aka memcg) in the Linux kern…
• CVE-2014-8172The filesystem implementation in the Linux kernel before 3.1…
• CVE-2014-8173The pmd_none_or_trans_huge_or_clear_bad function in include/…
• CVE-2014-8174eDeploy makes it easier for remote attackers to execute arbi…
• CVE-2014-8175Red Hat JBoss Fuse before 6.2.0 allows remote authenticated …