lv: privilege escalation [LWN.net]

Package(s):

CVE #(s):

CAN-2003-0188

Created:

May 16, 2003

Updated:

June 4, 2003

Description:

Leonard Stiles discovered that lv, a multilingual file viewer, would read options from a configuration file in the current directory. Because such a file could be placed there by a malicious user, and lv configuration options can be used to execute commands, this represented a security vulnerability. An attacker could gain the privileges of the user invoking lv, including root.

Alerts:

Yellow Dog	YDU-20030602-6	2003-06-02
Gentoo	200305-07	2003-05-19
Red Hat	RHSA-2003:169-01	2003-05-16
Debian	DSA-304-1	2003-05-15

(Log in to post comments)