CVE-2010-3847

Priority
Negligible
Description
elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through
2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of
$ORIGIN for the LD_AUDIT environment variable, which allows local users to
gain privileges via a crafted dynamic shared object (DSO) located in an
arbitrary directory.
References
Notes
kees> $ORIGIN expansion was not possible on Ubuntu due to lack of NDEBUG during build.
Package
Source: glibc (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 8.04 LTS (Hardy Heron):released (2.7-10ubuntu7)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 11.04 (Natty Narwhal):DNE
Package
Upstream:needs-triage
Ubuntu 8.04 LTS (Hardy Heron):DNE
Ubuntu 10.04 LTS (Lucid Lynx):released (2.11.1-0ubuntu7.5)
Ubuntu 11.04 (Natty Narwhal):not-affected
More Information

Valid XHTML 1.0 Strict

Updated: 2012-06-01 15:21:29 UTC (commit 5347)