Unscored severity · published Nov 5, 2010
CVE-2010-3999
gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared…
–
CVSS
0.3%
EPSS
No
On KEV
Description
gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnucash · Gnucash
through 2.3.15; 1.8.3; 1.8.4; 1.8.5; 2.0.0; 2.0.1; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3999
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050269.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050164.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050177.html
secunia.com
http://secunia.com/advisories/42048
secunia.com
http://secunia.com/advisories/42054
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2010:241
More from Gnucash
–
CVE-2007-0007
gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files