CVE-2014-8517: Apple Mac OS X

High severity, CVSS 7.5. EPSS: 69.1% chance of exploitation in the next 30 days.

The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.

Affected products

• Apple Mac OS X: version 10.8.5 only; version 10.9.5 only; version 10.10.0 only; version 10.10.1 only
• Netbsd Netbsd: version 5.1 only; version 5.1.1 only; version 5.1.2 only; version 5.1.3 only; version 5.1.4 only; version 5.2 only; …

Published 2014-11-17. Last modified 2026-06-17.