CVE-2010-3359

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-12 · updated 2026-06-16
Weakness: CWE-20

Description

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.

Affected products

Debian Linux: 8.0, 9.0, 10.0
Gargoyle Project Gargoyle: before 2009-08-25 — fixed in 2009-08-25

How to fix

Upgrade to a fixed version: Gargoyle Project Gargoyle 2009-08-25. Check the vendor advisory for mitigations.

References

https://security-tracker.debian.org/tracker/CVE-2010-3359
https://security-tracker.debian.org/tracker/CVE-2010-3359

Get alerted when CVE-2010-3359 or the next vulnerability affects your stack