CVE-2010-3996 — Vulnetix

CVE-2010-3996 REJECTED

festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

EPSS 0.05% · 14.9th percentile

Risk Scores

EPSS Score

0.05%

14.9th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:14.04:LTS	festival	0

Exploit Intelligence

44395 (circl)
SUSE-SR:2010:020 (circl)
[opensuse-updates] 20101022 openSUSE-SU-2010:0756-1 (moderate): festival security update (circl)
https://bugzilla.novell.com/show_bug.cgi?id=642507 (circl)
SUSE-SR:2010:019 (circl)

Timeline

Nov 5, 2010 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 17, 2022 CVE Updated
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 2, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2010-3996 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2010-3996 third-party-advisory

Open in Interactive Console →