Candidate: CVE-2010-3387
PublicDate: 2010-10-20 18:00:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3387
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598308
Description:
 ** DISPUTED **  vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a
 zero-length directory name in the LD_LIBRARY_PATH, which allows local users
 to gain privileges via a Trojan horse shared library in the current working
 directory.  NOTE: a third party disputes this issue because the script
 erroneously uses a semicolon in a context where a colon was intended.
Ubuntu-Description:
Notes:
Bugs:
 https://bugs.launchpad.net/ubuntu/+source/vdr/+bug/930700/
Priority: low
Discovered-by:
Assigned-to:
CVSS: 

Patches_vdr:
 other: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/natty/vdr/natty/revision/24#debian/vdrleaktest
 other: http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/natty/vdr/natty/revision/25#debian/vdrleaktest
upstream_vdr: released (1.6.0-18.1)
dapper_vdr: ignored (reached end-of-life)
hardy_vdr: ignored (reached end-of-life)
jaunty_vdr: ignored (reached end-of-life)
karmic_vdr: ignored (reached end-of-life)
lucid_vdr: ignored (reached end-of-life)
maverick_vdr: ignored (reached end-of-life)
natty_vdr: not-affected (1.6.0-19ubuntu1)
oneiric_vdr: not-affected (1.6.0-19ubuntu1)
precise_vdr: not-affected (1.6.0-19ubuntu1)
quantal_vdr: not-affected (1.6.0-19ubuntu1)
raring_vdr: not-affected (1.6.0-19ubuntu1)
saucy_vdr: not-affected (1.6.0-19ubuntu1)
devel_vdr: not-affected (1.6.0-19ubuntu1)