Description
Multiple untrusted search path vulnerabilities in SUSE Linux 9.3 and 10.0, and possibly other distributions, cause the working directory to be added to LD_LIBRARY_PATH, which might allow local users to execute arbitrary code via (1) beagle, (2) tomboy, or (3) blam. NOTE: in August 2007, the tomboy vector was reported for other distributions.
References
- http://bugs.gentoo.org/show_bug.cgi?id=188806
- http://bugs.gentoo.org/show_bug.cgi?id=199841
- 27621 third-party-advisory
- 27608 third-party-advisory
- 28672 third-party-advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=485224
- MDVSA-2008:064 vendor-advisory
- 39578 vdb-entry
- 27799 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=362941
- http://bugs.gentoo.org/show_bug.cgi?id=189249
- 26480 third-party-advisory
- SUSE-SR:2005:022 vendor-advisory
- 28339 third-party-advisory
- GLSA-200711-12 vendor-advisory
- 39577 vdb-entry
- 25341 vdb-entry
- FEDORA-2007-3011 vendor-advisory
- USN-560-1 vendor-advisory
- FEDORA-2007-3792 vendor-advisory
- tomboy-ldlibrarypath-privilege-escalation(36054) vdb-entry
- GLSA-200801-14 vendor-advisory