CVE-2009-5064

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-50654.3Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows r CVE-2009-50662.1twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the crede CVE-2009-50674.3Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include CVE-2009-50687.2There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF depl CVE-2009-507110.0Unspecified vulnerability in Palm Pre WebOS before 1.2.1 has unknown impact and attack vectors related to an "included contact template file CVE-2009-50724.0Memory leak in the ldap_explode_dn function in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.61 (aka 6.0.0.8-TIV-ITDS-IF0003) allows re CVE-2009-50734.0IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of s CVE-2009-507410.0Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vecto CVE-2009-50754.3Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file.CVE-2009-50767.5CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator CVE-2009-50777.5CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modifie CVE-2009-50786.5contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows re