CVE-2010-3359

MediumCVSS 4.8/10Last modified Jun 16, 2026

Description

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Nov 12, 2019
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2010

CVE-2010-33606.9Hipo 0.6.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse sharedCVE-2010-33616.9The (1) iked, (2) ikea, and (3) ikec scripts in Shrew Soft IKE 2.1.5 place a zero-length directory name in the LD_LIBRARY_PATH, which allowsCVE-2010-33626.9lastfm 1.5.4 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse sharCVE-2010-33636.9roarify in roaraudio 0.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a TrojaCVE-2010-33646.9The vips-7.22 script in VIPS 7.22.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges CVE-2010-33656.9Mistelix 0.31 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shaCVE-2010-33666.9Mn_Fit 5.13 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shareCVE-2010-33696.9The (1) mdb and (2) mdb-symbolreader scripts in mono-debugger 2.4.3, and other versions before 2.8.1, place a zero-length directory name in CVE-2010-33726.9Untrusted search path vulnerability in NorduGrid Advanced Resource Connector (ARC) before 0.8.3 allows local users to gain privileges via veCVE-2010-33735.5paxtest handles temporary files insecurelyCVE-2010-33746.9Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a TrojanCVE-2010-33759.8qtparted has insecure library loading which may allow arbitrary code execution
CVE-2010-3359: Medium severity, CVSS 4.8 | Vulnix