Skip to content
OpenAdvisories
Unscored CVE-2010-3359 EUVD-2010-3357GHSA-wfv9-547j-vw5h

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a loca…

Published Nov 12, 2019 · Updated Aug 7, 2024 · Assigned by mitre

Description

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 gargoyle-free 2009-08-25-2 —
Debian 13 gargoyle-free 2009-08-25-2 —
Debian 12 gargoyle-free 2009-08-25-2 —

References