What’s Vulnerable › Vulnerabilities

CVE-2016-10151

• Severity: high (CVSS 7.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-03-01 · updated 2026-06-17
• Weakness: CWE-264

Description

The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.

Affected products

• Hesiod Project Hesiod: 3.2.1

References

• http://www.openwall.com/lists/oss-security/2017/01/21/1
• http://www.securityfocus.com/bid/90952
• https://bugzilla.redhat.com/show_bug.cgi?id=1332508
• https://github.com/achernya/hesiod/pull/9
• https://security.gentoo.org/glsa/201805-01
• http://www.openwall.com/lists/oss-security/2017/01/21/1
• http://www.securityfocus.com/bid/90952
• https://bugzilla.redhat.com/show_bug.cgi?id=1332508
• https://github.com/achernya/hesiod/pull/9
• https://security.gentoo.org/glsa/201805-01

Get alerted when CVE-2016-10151 or the next vulnerability affects your stack