Description
If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2010-3359
Scores
CVSS v3
4.8
EPSS
0.0031
EPSS Percentile
23.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Details
CWE
CWE-20
Status
published
Products (4)
debian/debian_linux
8.0
debian/debian_linux
9.0
debian/debian_linux
10.0
gargoyle_project/gargoyle
< 2009-08-25
Published
Nov 12, 2019
Tracked Since
Feb 18, 2026