CVE-2014-2094: Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is...

Security readout for executives and security teams

Catfish could be tricked into loading a malicious compiled Python file from the directory where it starts. A local user who can place that file may gain privileges through the person running Catfish. The provided sources do not show remote exposure or active exploitation. Exposure is most likely on systems running Catfish through 0.4.0.3 from vulnerable non-Fedora packaging or source-style installs. The bundle does not identify affected CPEs or all distributions. Treat this as a targeted local privilege risk, not an internet-wide emergency. Prioritize shared Linux desktops, lab machines, and environments where untrusted local users may influence working directories. Mitigation focus: Inventory Catfish installations and versions across managed Linux endpoints.; Prefer distribution packages with vendor fixes, where available.; Check Red Hat, Debian, or upstream guidance for exact fixed builds..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.