gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade gnucash | Jul 30, 2024 | Nov 5, 2010 |
| Gentoo Linux | — | Upgrade net-libs/libsoup.Upgrade sys-apps/shadow.Upgrade app-office/gnucash.Upgrade sys-fs/lvm2.Upgrade net-misc/rsync.Upgrade media-libs/fmod.Upgrade gnome-base/gdm.Upgrade dev-db/unixODBC.Upgrade dev-vcs/gitolite.Upgrade dev-php/PEAR-Mail.Upgrade net-misc/vino.Upgrade net-misc/mrouted.Upgrade x11-apps/xrdb.Upgrade dev-php/PEAR-PEAR.Upgrade net-libs/webkit-gtk.Upgrade net-analyzer/sflowtool.Upgrade dev-libs/xmlsec.Upgrade app-misc/ca-certificates.Upgrade dev-util/oprofile.Upgrade sys-cluster/resource-agents.Upgrade dev-util/qt-creator.Upgrade media-libs/xine-lib.Upgrade games-sports/racer-bin.Upgrade media-sound/lastfmplayer.Upgrade app-admin/syslog-ng. | Oct 30, 2017 | Nov 5, 2010 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub