Vulnerability in Banshee-Project Banshee
CVE-2010-3998
The (1) banshee-1 and (2) muinshee scripts in Banshee 1.8.0 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: Banshee might also be affected using GST_PLUGIN_PATH.
EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.
Affected products
- Banshee-project Banshee — versions 1.4.3, 1.4, 1.5.2
- N/a — versions n/a
References
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA)
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Exploit)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA)