Vulnerability in Conectiva Linux

CVE-2001-0170

glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files.

EPSS: 0.008 (54.2th percentile) — read the EPSS interpretation.

Affected products

Conectiva Linux — versions 4.0, 4.0es, 4.1
Immunix — versions 7.0_beta
Debian Debian_linux — versions 2.3
Redhat Linux — versions 7.0
N/a — versions n/a

References

cve@mitre.org (vdb-entry, x_refsource_XF)
cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Patch, Vendor Advisory)
cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ, Patch)
cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)