CVE-2010-3999

Published: Nov 5, 2010Modified: Apr 29, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

Affected (31)

Products: Gnucash: Gnucash

1 product

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Gnucash Gnucash	version ≤ 2.3.15
Gnucash Gnucash	Version 1.8.3
Gnucash Gnucash	Version 1.8.4
Gnucash Gnucash	Version 1.8.5
Gnucash Gnucash	Version 2.0.0
Gnucash Gnucash	Version 2.0.1
Gnucash Gnucash	Version 2.2.0
Gnucash Gnucash	Version 2.2.1
Gnucash Gnucash	Version 2.2.2
Gnucash Gnucash	Version 2.2.3
Gnucash Gnucash	Version 2.2.4
Gnucash Gnucash	Version 2.2.5
Gnucash Gnucash	Version 2.2.6
Gnucash Gnucash	Version 2.2.7
Gnucash Gnucash	Version 2.2.8
Gnucash Gnucash	Version 2.2.9
Gnucash Gnucash	Version 2.3.0
Gnucash Gnucash	Version 2.3.10
Gnucash Gnucash	Version 2.3.11
Gnucash Gnucash	Version 2.3.12
Gnucash Gnucash	Version 2.3.13
Gnucash Gnucash	Version 2.3.14
Gnucash Gnucash	Version 2.3.1
Gnucash Gnucash	Version 2.3.2
Gnucash Gnucash	Version 2.3.3
Gnucash Gnucash	Version 2.3.4
Gnucash Gnucash	Version 2.3.5
Gnucash Gnucash	Version 2.3.6
Gnucash Gnucash	Version 2.3.7
Gnucash Gnucash	Version 2.3.8
Gnucash Gnucash	Version 2.3.9

References (22)

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050269.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050164.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050177.html

Source: cve@mitre.org

http://secunia.com/advisories/42048

Source: cve@mitre.org

http://secunia.com/advisories/42054

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2010:241

Source: cve@mitre.org

http://www.securityfocus.com/bid/44563

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/2848

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/2898

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/3060

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=644933

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050269.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050164.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050177.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42048

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42054

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:241

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/44563

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2848

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2898

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/3060

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=644933

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.