CVE-2010-3999

Related Files

Mandriva Linux Security Advisory 2010-241

Posted Nov 24, 2010

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-241 - gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. The affected /usr/bin/gnc-test-env file has been removed to mitigate the vulnerability as gnc-test-env is only used for tests and while building gnucash. Additionally for Mandriva 2010.1 gnucash-2.2.9 was not compatible with guile. This update adapts gnucash to the new API of guile.

tags | advisory, local, trojan

systems | linux, mandriva

advisories | CVE-2010-3999

SHA-256 | f6ba7fc2153de0d6d4e2127713a15491bdc57288a34cad682323920481676a39

Download | Favorite | View