CVE-2010-4000
published 2010-11-06CVE-2010-4000: gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse…
PriorityP421medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
0.31%
22.8th percentile
gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gnome-shell | < gnome-shell 2.91.3-1 (bookworm) | gnome-shell 2.91.3-1 (bookworm) |
| gnome | gnome-shell | — | — |
| gnome | gnome-shell | >= 0 < 2.91.3-1 | 2.91.3-1 |
| gnome | gnome-shell | >= 0 < 2.91.3-1 | 2.91.3-1 |
| gnome | gnome-shell | >= 0 < 2.91.3-1 | 2.91.3-1 |
| gnome | gnome-shell | >= 0 < 2.91.3-1 | 2.91.3-1 |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_debian6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2010-4000: gnome-shell - gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_...
vendor_debian·2010·CVSS 6.9
CVE-2010-4000 [MEDIUM] CVE-2010-4000: gnome-shell - gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_...
gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Scope: local
bookworm: resolved (fixed in 2.91.3-1)
bullseye: resolved (fixed in 2.91.3-1)
forky: resolved (fixed in 2.91.3-1)
sid: resolved (fixed in 2.91.3-1)
trixie: resolved (fixed in 2.91.3-1)
GHSA
GHSA-gm3m-g83g-8676: gnome-shell in GNOME Shell 2
ghsa_unreviewed·2022-05-17
CVE-2010-4000 [MEDIUM] GHSA-gm3m-g83g-8676: gnome-shell in GNOME Shell 2
gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
OSV
CVE-2010-4000: gnome-shell in GNOME Shell 2
osv·2010-11-06·CVSS 6.9
CVE-2010-4000 [MEDIUM] CVE-2010-4000: gnome-shell in GNOME Shell 2
gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
No detection rules found.
Bugzilla
OpenJDK Incomplete Fix for CVE-2010-4469
bugzilla·2011-02-18·CVSS 10.0
CVE-2010-4469 [CRITICAL] OpenJDK Incomplete Fix for CVE-2010-4469
OpenJDK Incomplete Fix for CVE-2010-4469
it looks like the fix for CVE-2010-4469 is incomplete,
and still causes segmentation faults in latest 6u24.
The reproducer class was generated with
java GenOOMCrashClass 1 4000, where 1 the number
of methods and 4000 the number of nested backward JSRs.
Please check the attached reproducer OOMCrashClass4000_1,
gdb --args /usr/java/jre1.6.0_24/bin/java -cp bin OOMCrashClass4000_1
it dies with:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb721eb90 (LWP 1239)]
0xb75bcd2e in GenerateOopMap::copy_state(CellTypeState*, CellTypeState*)
() from /usr/java/jre1.6.0_24/lib/i386/server/libjvm.so
(gdb) info r
eax 0x42000000 1107296256
ecx 0x80ec3010 -2132004848
edx 0x47000000 1191182336
ebx 0x0 0
esp 0xb721dd2c 0xb721dd2c
ebp 0
Bugzilla
CVE-2010-4000 gnome-shell: insecure library loading vulnerability [fedora-all]
bugzilla·2010-10-20·CVSS 6.9
CVE-2010-4000 [MEDIUM] CVE-2010-4000 gnome-shell: insecure library loading vulnerability [fedora-all]
CVE-2010-4000 gnome-shell: insecure library loading vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=644561
Please note: this issue affects mult
Bugzilla
CVE-2010-4000 gnome-shell: insecure library loading vulnerability
bugzilla·2010-10-19·CVSS 6.9
CVE-2010-4000 [MEDIUM] CVE-2010-4000 gnome-shell: insecure library loading vulnerability
CVE-2010-4000 gnome-shell: insecure library loading vulnerability
Ludwig Nussel discovered that gnome-shell contained a script that could be abused by an attacker to execute arbitrary code.
The vulnerability is due to an insecure change to LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for libraries in directories other than the standard paths. When there is an empty item in the colon-separated list of directories in LD_LIBRARY_PATH, ld.so(8) treats it as a '.' (current working directory). If the given script is executed from a directory where a local attacker could write files, there is a chance for exploitation.
In Fedora, /usr/bin/gnome-shell re-sets LD_LIBRARY_PATH insecurely:
163 if os.path.exists(mozjs_libdir + '/libmozjs.so'):
164 env['LD_LIBRARY_PATH'] = os.
2010-11-06
Published