CVE-2014-3219: fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log...

Security readout for executives and security teams

CVE-2014-3219 affects fish shell versions before 2.1.1. A local user could abuse predictable temporary log or cache file paths to write to unintended files through symlinks. This is mainly a risk on older systems where fish is installed and local users can run it. Exposure is likely limited to legacy Unix or Linux hosts with fish shell versions before 2.1.1. Distribution advisories from Gentoo, Fedora, and openSUSE indicate packaged deployments were relevant. Systems without fish, or with fish updated beyond 2.1.1, are not indicated as affected by the provided sources. Treat this as a legacy hygiene and local privilege-boundary issue, not an internet-scale emergency. Prioritize it where shared systems, developer workstations, or older images still run vulnerable fish versions. Remediation should be straightforward through package updates or removal. Mitigation focus: Upgrade fish shell to version 2.1.1 or later.; Use vendor-supported distro packages from Gentoo, Fedora, openSUSE, or your platform vendor.; Remove obsolete fish packages where the shell is not required..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.