Summary
It was discovered that the GNU C Library incorrectly search LD_LIBRARY_PATH
to determine which library to load when statically linked setuid binary
calls dlopen. A local attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | glibc | 2.31-0ubuntu9.18 |
| Ubuntu · 22.04 LTS 22.04:LTS | glibc | 2.35-0ubuntu3.10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | glibc | 2.27-3ubuntu1.6+esm5 |
Vulnerabilities 1
-
High 7.8CVE-2025-4802 Public exploit
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker …
References
-
report
https://ubuntu.com/security/CVE-2025-4802