CVE-2008-5983
published 2009-01-28CVE-2008-5983: Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to…
PriorityP420medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
0.51%
40.1th percentile
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
Affected
67 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| csound | csound | — | — |
| csound | csound | >= 0 < 5.08.2~dfsg-1.1 | 5.08.2~dfsg-1.1 |
| csound | csound | >= 0 < 5.08.2~dfsg-1.1 | 5.08.2~dfsg-1.1 |
| csound | csound | >= 0 < 5.08.2~dfsg-1.1 | 5.08.2~dfsg-1.1 |
| csound | csound | >= 0 < 5.08.2~dfsg-1.1 | 5.08.2~dfsg-1.1 |
| debian | csound | < csound 5.08.2~dfsg-1.1 (bookworm) | csound 5.08.2~dfsg-1.1 (bookworm) |
| debian | dia | < dia 0.96.1-7.1 (bookworm) | dia 0.96.1-7.1 (bookworm) |
| debian | eog | < eog 2.22.3-2 (bookworm) | eog 2.22.3-2 (bookworm) |
| debian | epiphany-browser | < epiphany-browser 2.22.3-7 (bookworm) | epiphany-browser 2.22.3-7 (bookworm) |
| debian | gedit | < gedit 2.22.3-2 (bookworm) | gedit 2.22.3-2 (bookworm) |
| debian | gnumeric | < gnumeric 1.8.4-3 (bookworm) | gnumeric 1.8.4-3 (bookworm) |
| debian | nautilus-python | < nautilus-python 0.4.3-3.2 (bookworm) | nautilus-python 0.4.3-3.2 (bookworm) |
| debian | vim | < vim 2:7.2.025-2 (bookworm) | vim 2:7.2.025-2 (bookworm) |
| dia | dia | — | — |
| dia | dia | >= 0 < 0.96.1-7.1 | 0.96.1-7.1 |
| dia | dia | >= 0 < 0.96.1-7.1 | 0.96.1-7.1 |
| dia | dia | >= 0 < 0.96.1-7.1 | 0.96.1-7.1 |
| dia | dia | >= 0 < 0.96.1-7.1 | 0.96.1-7.1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| gnome | eog | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_debian6.9LOW
vendor_redhat6.9MEDIUM
vendor_ubuntu6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Python 3.1 vulnerabilities
vendor_ubuntu·2012-10-24·CVSS 6.9
CVE-2008-5983 [MEDIUM] Python 3.1 vulnerabilities
Title: Python 3.1 vulnerabilities
Summary: Several security issues were fixed in Python 3.1.
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
This issue only affected Ubuntu 10.04 LTS. (CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. These issues only affected Ubuntu 10.04 LTS.
(CVE-2010-1634, CVE-2010-2089)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker co
Ubuntu
Python 2.5 vulnerabilities
vendor_ubuntu·2012-10-17·CVSS 6.9
CVE-2008-5983 [MEDIUM] Python 2.5 vulnerabilities
Title: Python 2.5 vulnerabilities
Summary: Several security issues were fixed in Python 2.5.
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd module.
A remote attacker could exploit this to cause a denial of service via
daemon outage. (CVE-2010-3493)
It was discovered that the CGIHTT
Ubuntu
Python 2.4 vulnerabilities
vendor_ubuntu·2012-10-17·CVSS 6.9
CVE-2010-2089 [MEDIUM] Python 2.4 vulnerabilities
Title: Python 2.4 vulnerabilities
Summary: Several security issues were fixed in Python 2.4.
USN-1613-1 fixed vulnerabilities in Python 2.5. This update provides the
corresponding updates for Python 2.4.
Original advisory details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd mod
Ubuntu
Python 2.6 vulnerabilities
vendor_ubuntu·2012-10-04·CVSS 6.9
CVE-2008-5983 [MEDIUM] Python 2.6 vulnerabilities
Title: Python 2.6 vulnerabilities
Summary: Several security issues were fixed in Python 2.6.
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd module.
A remote attacker could exploit this to cause a denial of service via
daemon outage. (CVE-2010-3493)
It was discovered that the CGIHTT
Debian
CVE-2009-0317: nautilus-python - Untrusted search path vulnerability in the Python language bindings for Nautilus...
vendor_debian·2009·CVSS 6.9
CVE-2009-0317 [MEDIUM] CVE-2009-0317: nautilus-python - Untrusted search path vulnerability in the Python language bindings for Nautilus...
Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 0.4.3-3.2)
bullseye: resolved (fixed in 0.4.3-3.2)
forky: resolved (fixed in 0.4.3-3.2)
sid: resolved (fixed in 0.4.3-3.2)
trixie: resolved (fixed in 0.4.3-3.2)
Debian
CVE-2009-0314: gedit - Untrusted search path vulnerability in the Python module in gedit allows local u...
vendor_debian·2009·CVSS 6.9
CVE-2009-0314 [MEDIUM] CVE-2009-0314: gedit - Untrusted search path vulnerability in the Python module in gedit allows local u...
Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 2.22.3-2)
bullseye: resolved (fixed in 2.22.3-2)
forky: resolved (fixed in 2.22.3-2)
sid: resolved (fixed in 2.22.3-2)
trixie: resolved (fixed in 2.22.3-2)
Debian
CVE-2009-0316: vim - Untrusted search path vulnerability in src/if_python.c in the Python interface i...
vendor_debian·2009·CVSS 6.9
CVE-2009-0316 [MEDIUM] CVE-2009-0316: vim - Untrusted search path vulnerability in src/if_python.c in the Python interface i...
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
Scope: local
bookworm: resolved (fixed in 2:7.2.025-2)
bullseye: resolved (fixed in 2:7.2.025-2)
forky: resolved (fixed in 2:7.2.025-2)
sid: resolved (fixed in 2:7.2.025-2)
trixie: resolved (fixed in 2:7.2.025-2)
Debian
CVE-2009-0318: gnumeric - Untrusted search path vulnerability in the GObject Python interpreter wrapper in...
vendor_debian·2009·CVSS 6.9
CVE-2009-0318 [MEDIUM] CVE-2009-0318: gnumeric - Untrusted search path vulnerability in the GObject Python interpreter wrapper in...
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 1.8.4-3)
bullseye: resolved (fixed in 1.8.4-3)
forky: resolved (fixed in 1.8.4-3)
sid: resolved (fixed in 1.8.4-3)
trixie: resolved (fixed in 1.8.4-3)
Red Hat
eog: untrusted python modules search path
vendor_redhat·2008-11-02·CVSS 6.9
CVE-2008-5987 [MEDIUM] eog: untrusted python modules search path
eog: untrusted python modules search path
Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Statement: This issue does not affect the versions of the eog package, as shipped with Red Hat Enterprise Linux 3, 4, and 5.
Red Hat
dia: untrusted python modules search path
vendor_redhat·2008-11-02·CVSS 6.9
CVE-2008-5984 [MEDIUM] dia: untrusted python modules search path
dia: untrusted python modules search path
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Red Hat
csound: untrusted python modules search path
vendor_redhat·2008-11-02·CVSS 6.9
CVE-2008-5986 [MEDIUM] csound: untrusted python modules search path
csound: untrusted python modules search path
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Red Hat
python: untrusted python modules search path
vendor_redhat·2008-08-06·CVSS 6.9
CVE-2008-5983 [MEDIUM] python: untrusted python modules search path
python: untrusted python modules search path
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
Red Hat
Gnumeric: untrusted python modules search path
vendor_redhat·2008-08-06·CVSS 6.9
CVE-2009-0318 [MEDIUM] Gnumeric: untrusted python modules search path
Gnumeric: untrusted python modules search path
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Red Hat
vim: untrusted python modules search path
vendor_redhat·2008-08-06·CVSS 6.9
CVE-2009-0316 [MEDIUM] vim: untrusted python modules search path
vim: untrusted python modules search path
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
Statement: This issue did not affect vim as shipped in Red Hat Enterprise Linux 3 and 4. This issue is not planned to be fixed in vim packages in Red Hat Enterprise Linux 5.
Package: vim (Red Hat Enterprise Linux 4) - Not affected
Package: vim (Red Hat Enterprise Linux 5) - Will not fix
Red Hat
nautilus-python: untrusted python modules search path
vendor_redhat·2008-08-06·CVSS 6.9
CVE-2009-0317 [MEDIUM] nautilus-python: untrusted python modules search path
nautilus-python: untrusted python modules search path
Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Red Hat
gedit: untrusted python modules search path
vendor_redhat·2008-08-06·CVSS 6.9
CVE-2009-0314 [MEDIUM] gedit: untrusted python modules search path
gedit: untrusted python modules search path
Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Statement: This issue does not affect gedit as shipped in Red Hat Enterprise Linux 3 and 4. It does affect gedit in Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: gedit (Red Hat Enterprise Linux 5) - Will not fix
Red Hat
xchat: untrusted python modules search path
vendor_redhat·2008-08-06·CVSS 6.9
CVE-2009-0315 [MEDIUM] xchat: untrusted python modules search path
xchat: untrusted python modules search path
Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: xchat (Red Hat Enterprise Linux 4) - Will not fix
Package: xchat (Red Hat Enterprise Linux 5) - Will not fix
Package: xchat (Red Hat Enterprise Linux 6) - Will not fix
Debian
CVE-2008-5986: csound - Untrusted search path vulnerability in the (1) "VST plugin with Python scripting...
vendor_debian·2008·CVSS 6.9
CVE-2008-5986 [MEDIUM] CVE-2008-5986: csound - Untrusted search path vulnerability in the (1) "VST plugin with Python scripting...
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 5.08.2~dfsg-1.1)
bullseye: resolved (fixed in 5.08.2~dfsg-1.1)
forky: resolved (fixed in 5.08.2~dfsg-1.1)
sid: resolved (fixed in 5.08.2~dfsg-1.1)
trixie: resolved (fixed in 5.08.2~dfsg-1.1)
Debian
CVE-2008-5987: eog - Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog...
vendor_debian·2008·CVSS 6.9
CVE-2008-5987 [MEDIUM] CVE-2008-5987: eog - Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog...
Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 2.22.3-2)
bullseye: resolved (fixed in 2.22.3-2)
forky: resolved (fixed in 2.22.3-2)
sid: resolved (fixed in 2.22.3-2)
trixie: resolved (fixed in 2.22.3-2)
Debian
CVE-2008-5985: epiphany-browser - Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, ...
vendor_debian·2008·CVSS 6.9
CVE-2008-5985 [MEDIUM] CVE-2008-5985: epiphany-browser - Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, ...
Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 2.22.3-7)
bullseye: resolved (fixed in 2.22.3-7)
forky: resolved (fixed in 2.22.3-7)
sid: resolved (fixed in 2.22.3-7)
trixie: resolved (fixed in 2.22.3-7)
Debian
CVE-2008-5984: dia - Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and poss...
vendor_debian·2008·CVSS 6.9
CVE-2008-5984 [MEDIUM] CVE-2008-5984: dia - Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and poss...
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Scope: local
bookworm: resolved (fixed in 0.96.1-7.1)
bullseye: resolved (fixed in 0.96.1-7.1)
forky: resolved (fixed in 0.96.1-7.1)
sid: resolved (fixed in 0.96.1-7.1)
trixie: resolved (fixed in 0.96.1-7.1)
GHSA
GHSA-5mj6-92x2-j3r9: Untrusted search path vulnerability in the Python interface in Epiphany 2
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2008-5985 [MEDIUM] GHSA-5mj6-92x2-j3r9: Untrusted search path vulnerability in the Python interface in Epiphany 2
Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-4jhg-wfq8-3vgm: Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2
ghsa_unreviewed·2022-05-17
CVE-2008-5983 [MEDIUM] CWE-426 GHSA-4jhg-wfq8-3vgm: Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2
Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.
GHSA
GHSA-5g97-43jg-qgrv: Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2008-5987 [MEDIUM] GHSA-5g97-43jg-qgrv: Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2
Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-qgjp-57rj-4xx4: Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csoun
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2008-5986 [MEDIUM] GHSA-qgjp-57rj-4xx4: Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csoun
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-7fpg-fmpq-xxg2: Untrusted search path vulnerability in the Python plugin in Dia 0
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2008-5984 [MEDIUM] GHSA-7fpg-fmpq-xxg2: Untrusted search path vulnerability in the Python plugin in Dia 0
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-x433-429v-9473: Untrusted search path vulnerability in src/if_python
ghsa_unreviewed·2022-05-02·CVSS 6.9
CVE-2009-0316 [MEDIUM] GHSA-x433-429v-9473: Untrusted search path vulnerability in src/if_python
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
GHSA
GHSA-r26m-hp24-85qr: Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a
ghsa_unreviewed·2022-05-02·CVSS 6.9
CVE-2009-0317 [MEDIUM] GHSA-r26m-hp24-85qr: Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a
Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-f2r4-w89x-fvh9: Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the c
ghsa_unreviewed·2022-05-02·CVSS 6.9
CVE-2009-0315 [MEDIUM] GHSA-f2r4-w89x-fvh9: Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the c
Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-9cr7-r39p-2mx5: Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan ho
ghsa_unreviewed·2022-05-02·CVSS 6.9
CVE-2009-0318 [MEDIUM] GHSA-9cr7-r39p-2mx5: Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan ho
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
GHSA
GHSA-7wfg-2ggr-wcjc: Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the c
ghsa_unreviewed·2022-05-02·CVSS 6.9
CVE-2009-0314 [MEDIUM] CWE-426 GHSA-7wfg-2ggr-wcjc: Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the c
Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2008-5986: Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csoun
osv·2009-01-28·CVSS 6.9
CVE-2008-5986 [MEDIUM] CVE-2008-5986: Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csoun
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2008-5985: Untrusted search path vulnerability in the Python interface in Epiphany 2
osv·2009-01-28·CVSS 6.9
CVE-2008-5985 [MEDIUM] CVE-2008-5985: Untrusted search path vulnerability in the Python interface in Epiphany 2
Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2008-5987: Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2
osv·2009-01-28·CVSS 6.9
CVE-2008-5987 [MEDIUM] CVE-2008-5987: Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2
Untrusted search path vulnerability in the Python interface in Eye of GNOME (eog) 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2009-0317: Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a
osv·2009-01-28·CVSS 6.9
CVE-2009-0317 [MEDIUM] CVE-2009-0317: Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a
Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2008-5984: Untrusted search path vulnerability in the Python plugin in Dia 0
osv·2009-01-28·CVSS 6.9
CVE-2008-5984 [MEDIUM] CVE-2008-5984: Untrusted search path vulnerability in the Python plugin in Dia 0
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2009-0318: Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan ho
osv·2009-01-28·CVSS 6.9
CVE-2009-0318 [MEDIUM] CVE-2009-0318: Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan ho
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2009-0315: Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the c
osv·2009-01-28·CVSS 6.9
CVE-2009-0315 [MEDIUM] CVE-2009-0315: Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the c
Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2009-0314: Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the c
osv·2009-01-28·CVSS 6.9
CVE-2009-0314 [MEDIUM] CVE-2009-0314: Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the c
Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
OSV
CVE-2009-0316: Untrusted search path vulnerability in src/if_python
osv·2009-01-28·CVSS 6.9
CVE-2009-0316 [MEDIUM] CVE-2009-0316: Untrusted search path vulnerability in src/if_python
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-5983 python: untrusted python modules search path
bugzilla·2009-01-28·CVSS 6.9
CVE-2008-5983 [MEDIUM] CVE-2008-5983 python: untrusted python modules search path
CVE-2008-5983 python: untrusted python modules search path
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5983 to
the following vulnerability:
Untrusted search path vulnerability in the PySys_SetArgv API function
in Python before 2.6 prepends an empty string to sys.path when the
argv[0] argument does not contain a path separator, which might allow
local users to execute arbitrary code via a Trojan horse Python file
in the current working directory.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5983
http://www.mail-archive.com/[email protected]/msg586010.html
http://www.openwall.com/lists/oss-security/2009/01/26/2
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Bugzilla
CVE-2009-0315 xchat: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2009-0315 [MEDIUM] CVE-2009-0315 xchat: untrusted python modules search path
CVE-2009-0315 xchat: untrusted python modules search path
Untrusted search path vulnerability in the Python module of xchat allows local
users to execute arbitrary code via a Trojan horse Python file in the
current working directory, related to an erroneous setting of sys.path
by the PySys_SetArgv function.
References (test case, PoC):
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch:
The Debian patch for similar dia's Python related issue,
available at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
should be sufficient to resolve this issue.
Discussion:
This issue does NOT affect the version of the xchat package, as shipped
with Red Hat Enterprise Linux
Bugzilla
CVE-2008-5986 csound: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2008-5986 [MEDIUM] CVE-2008-5986 csound: untrusted python modules search path
CVE-2008-5986 csound: untrusted python modules search path
Untrusted search path vulnerability in Csound's "VST plugin with Python
scripting" and in "VST plugin for writing score generators in Python"
alows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the
PySys_SetArgv function.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359
Test case and more discussion about this issue available at:
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=1004-sanitize-sys.path.diff;att=1;bug=504359
Discussion:
This issue affects all versio
Bugzilla
CVE-2009-0318 Gnumeric: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2009-0318 [MEDIUM] CVE-2009-0318 Gnumeric: untrusted python modules search path
CVE-2009-0318 Gnumeric: untrusted python modules search path
Untrusted search path vulnerability in the GObject wrapper around Python interpreter allows local users to execute arbitrary code via a Trojan horse
Python file in the current working directory, related to an erroneous
setting of sys.path by the PySys_SetArgv function.
References (more details, test case):
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Relevant part of the code in
gnumeric-N.V.R/plugins/python-loader/gnm-py-interpreter.c:
103 PySys_SetArgv (G_N_ELEMENTS (plugin_argv) - 1, plugin_argv);
104 py_initgnumeric (interpreter);
Proposed patch:
The Debian patch for similar dia's Python related issue,
available at:
http://bugs.debian.org/cgi-bin/b
Bugzilla
CVE-2008-5984 dia: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2008-5984 [MEDIUM] CVE-2008-5984 dia: untrusted python modules search path
CVE-2008-5984 dia: untrusted python modules search path
Untrusted search path vulnerability in dia's Python plug-in alows local
users to execute arbitrary code via a Trojan horse Python file in
the current working directory, related to an erroneous setting of sys.path
by the PySys_SetArgv function.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251
Test case and more discussion about this issue (and reason's why it can't
be fixed in Python is available at):
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
Discussion:
This issue affects all versions of the dia package, as shipped with Red Hat
Bugzilla
CVE-2008-5985 epiphany: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2008-5985 [MEDIUM] CVE-2008-5985 epiphany: untrusted python modules search path
CVE-2008-5985 epiphany: untrusted python modules search path
Untrusted search path vulnerability in Epiphany's Python interface allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySys_SetArgv function.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504363
Test case available in:
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=sanitize_sys.path.diff;att=1;bug=504363
Patch notes:
The path for affected file in Fedora is BUILD/epiphany-N.V.R/src/ephy-python.c,
the proposed patch won't apply cleanly, but the change of:
++
Bugzilla
CVE-2008-5987 eog: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2008-5987 [MEDIUM] CVE-2008-5987 eog: untrusted python modules search path
CVE-2008-5987 eog: untrusted python modules search path
Untrusted search path vulnerability in eog's Python module allows local
users to execute arbitrary code via a Trojan horse Python file in the
current working directory, related to an erroneous setting of sys.path
by the PySys_SetArgv function.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504352#4
Test case and more details about this issue (reason's why it can't be
fixed in Python) are at:
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Debian patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=02_sanitize_sys.path.patch;att=1;bug=504352
Discussion:
This issue does NOT affect the versions of the eog package, as shipped
with Red H
Bugzilla
CVE-2009-0314 gedit: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2009-0314 [MEDIUM] CVE-2009-0314 gedit: untrusted python modules search path
CVE-2009-0314 gedit: untrusted python modules search path
Untrusted search path vulnerability in gedit's Python module allows local
users to execute arbitrary code via a Trojan horse Python file in the
current working directory, related to an erroneous setting of sys.path
by the PySys_SetArgv function.
References:
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Debian bug report for similar eog issue:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504352#4
Proposed patch:
Not sure, if gedi'ts upstream has been reported about this issue.
The Debian patch for similar eog's Python related issue,
available at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=02_sanitize_sys.path.patch;att=1;bug=504352
shou
Bugzilla
CVE-2009-0317 nautilus-python: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2009-0317 [MEDIUM] CVE-2009-0317 nautilus-python: untrusted python modules search path
CVE-2009-0317 nautilus-python: untrusted python modules search path
Untrusted search path vulnerability in the Python language bindings
for Nautilus allows local users to execute arbitrary code via a Trojan
horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySys_SetArgv function.
References (more details, PoC):
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch:
The Debian patch for similar dia's Python related issue,
available at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
should be sufficient to resolve this issue.
Discussion:
This issue affects all versions of the nautilus-python package, as shippe
Bugzilla
CVE-2009-0316 vim: untrusted python modules search path
bugzilla·2009-01-26·CVSS 6.9
CVE-2009-0316 [MEDIUM] CVE-2009-0316 vim: untrusted python modules search path
CVE-2009-0316 vim: untrusted python modules search path
Untrusted search path vulnerability in the of Vim allows local
users to execute arbitrary code via a Trojan horse Python file in the
current working directory, related to an erroneous setting of sys.path
by the PySys_SetArgv function.
References (test case, PoC):
http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html
Proposed patch:
The Debian patch for similar dia's Python related issue,
available at:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251
should be sufficient to resolve this issue.
Discussion:
This issue does NOT affect the version of the Vim package, as shipped
with Red Hat Enterprise Linux 2.1.
This issue af
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.htmlhttp://secunia.com/advisories/34522http://secunia.com/advisories/40194http://secunia.com/advisories/42888http://secunia.com/advisories/50858http://secunia.com/advisories/51024http://secunia.com/advisories/51040http://secunia.com/advisories/51087http://security.gentoo.org/glsa/glsa-200903-41.xmlhttp://security.gentoo.org/glsa/glsa-200904-06.xmlhttp://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg586010.htmlhttp://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.htmlhttp://www.openwall.com/lists/oss-security/2009/01/26/2http://www.openwall.com/lists/oss-security/2009/01/28/5http://www.openwall.com/lists/oss-security/2009/01/30/2http://www.redhat.com/support/errata/RHSA-2011-0027.htmlhttp://www.ubuntu.com/usn/USN-1596-1http://www.ubuntu.com/usn/USN-1613-1http://www.ubuntu.com/usn/USN-1613-2http://www.ubuntu.com/usn/USN-1616-1http://www.vupen.com/english/advisories/2010/1448http://www.vupen.com/english/advisories/2011/0122https://bugzilla.redhat.com/show_bug.cgi?id=482814http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042751.htmlhttp://secunia.com/advisories/34522http://secunia.com/advisories/40194http://secunia.com/advisories/42888http://secunia.com/advisories/50858http://secunia.com/advisories/51024http://secunia.com/advisories/51040http://secunia.com/advisories/51087http://security.gentoo.org/glsa/glsa-200903-41.xmlhttp://security.gentoo.org/glsa/glsa-200904-06.xmlhttp://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg586010.htmlhttp://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.htmlhttp://www.openwall.com/lists/oss-security/2009/01/26/2http://www.openwall.com/lists/oss-security/2009/01/28/5http://www.openwall.com/lists/oss-security/2009/01/30/2http://www.redhat.com/support/errata/RHSA-2011-0027.htmlhttp://www.ubuntu.com/usn/USN-1596-1http://www.ubuntu.com/usn/USN-1613-1http://www.ubuntu.com/usn/USN-1613-2http://www.ubuntu.com/usn/USN-1616-1http://www.vupen.com/english/advisories/2010/1448http://www.vupen.com/english/advisories/2011/0122https://bugzilla.redhat.com/show_bug.cgi?id=482814
2009-01-28
Published