Description
tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory.
References
- MDKSA-2002:060 vendor-advisory
- tcltk-insecure-library-search(6869) vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28226
- RHSA-2002:148 vendor-advisory
- 3073 vdb-entry
- CLA-2001:409 vendor-advisory