CVE Vulnerabilities

CVE-2008-4865

Published: Nov 01, 2008 | Modified: Mar 30, 2009
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
3.7 LOW
AV:L/AC:H/Au:N/C:P/I:P/A:P
RedHat/V3
Ubuntu

Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious –db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.

Affected Software

Name Vendor Start Version End Version
Valgrind Valgrind 1.9.6 1.9.6
Valgrind Valgrind 2.0.0 2.0.0
Valgrind Valgrind 2.1.0 2.1.0
Valgrind Valgrind 2.1.1 2.1.1
Valgrind Valgrind 2.2.0 2.2.0
Valgrind Valgrind 2.4.1 2.4.1
Valgrind Valgrind 2.4.1 2.4.1
Valgrind Valgrind 3.0.0 3.0.0
Valgrind Valgrind 3.0.1 3.0.1
Valgrind Valgrind 3.1.0 3.1.0
Valgrind Valgrind 3.1.1 3.1.1
Valgrind Valgrind 3.2.0 3.2.0
Valgrind Valgrind 3.2.1 3.2.1
Valgrind Valgrind 3.2.2 3.2.2
Valgrind Valgrind 3.2.3 3.2.3
Valgrind Valgrind 3.3.0 3.3.0
Valgrind Valgrind 3.3.0 3.3.0
Valgrind Valgrind 3.3.0 3.3.0
Valgrind Valgrind 3.3.0 3.3.0
Valgrind Valgrind 3.3.1 3.3.1
Valgrind Valgrind 3.3.1 3.3.1
Valgrind Valgrind * 3.4.0
Red Hat Enterprise Linux 5 RedHat valgrind-1:3.5.0-1.el5 *
Valgrind Ubuntu dapper *
Valgrind Ubuntu gutsy *
Valgrind Ubuntu hardy *
Valgrind Ubuntu intrepid *
Valgrind Ubuntu upstream *

References