Novell Home

CVE-2010-3996

Common Vulnerabilities and Exposures

[Previous] [Index] [Next]

Upstream information

CVE-2010-3996 at MITRE

Description

festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

NVD CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Novell/SUSE information

Novell Bugzilla entry: 642507

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE 11.1
  • festival-debuginfo >= 1.96-72.71.1
  • festival-debugsource >= 1.96-72.71.1
openSUSE 11.1
  • festival >= 1.96-72.71.1
  • festival-devel >= 1.96-72.71.1
openSUSE 11.2
  • festival-debuginfo >= 1.96-122.3.1
  • festival-debugsource >= 1.96-122.3.1
openSUSE 11.2
  • festival >= 1.96-122.3.1
  • festival-devel >= 1.96-122.3.1
openSUSE 11.3
  • festival-debuginfo >= 1.96-126.3.1
  • festival-debugsource >= 1.96-126.3.1
openSUSE 11.3
  • festival >= 1.96-126.3.1
  • festival-devel >= 1.96-126.3.1

© 2013 Novell