Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2010-3393: Magics++ 2.10.0 lets local users run their own code
CVE-2010-3393 · published 16 years ago
Summary
The Magics++ 2.10.0 setup script adds an empty entry to the library search path, causing the system to look in the current folder for shared libraries. A user who can place a malicious library in that folder could have it executed with higher privileges. Update to a newer version or modify the script to remove the empty path entry.
What to do
- Update debian magics++ to version 2.10.0.dfsg-5.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | magics++ |
< 2.10.0.dfsg-5.1 Fix: upgrade to 2.10.0.dfsg-5.1
|
| Debian:13 | debian | magics++ |
< 2.10.0.dfsg-5.1 Fix: upgrade to 2.10.0.dfsg-5.1
|
| Debian:14 | debian | magics++ |
< 2.10.0.dfsg-5.1 Fix: upgrade to 2.10.0.dfsg-5.1
|
| – | ecmwf | magics\+\+ |
2.10.0 cpe:2.3:a:ecmwf:magics\+\+:2.10.0:*:*:*:*:*:*:* |
Original advisory text
magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working dir...
magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
References
- https://security-tracker.debian.org/tracker/CVE-2010-3393 Vendor Advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598418 Exploit Patch
Severity
6.9
Medium
Timeline
Published20 Oct 2010
Updated4 Nov 2026
First seen4 Sep 2026
Track software like this
Free during beta