CVE-2005-0023 gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed.
LowCVSS 2.1
EPSS 0.89%
- Published
- Updated
- Exploit status
- No public exploit known
Description
gnome-pty-helper in GNOME libzvt2 and libvte4 allows local users to spoof the logon hostname via a modified DISPLAY environment variable. NOTE: the severity of this issue has been disputed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME libvte4 | All versions | No fix listed |
| GNOME libzvt2 | = 1.4.2.19 | No fix listed |
| debian/vte(Debian:12) | All versions | No fix listed |
| debian/vte(Debian:12) | = 1:0.28.2-6 | No fix listed |
| debian/vte(Debian:12) | = 1:0.28.2-6.1 | No fix listed |
| debian/vte(Debian:12) | = 1:0.28.2-6.1~exp1 | No fix listed |
| debian/vte(Debian:12) | = 1:0.28.2-6.1~exp2 | No fix listed |
| debian/vte(Debian:12) | = 1:0.28.2-7 | No fix listed |
| debian/vte(Debian:13) | All versions | No fix listed |
| debian/vte(Debian:13) | = 1:0.28.2-7 | No fix listed |
| debian/vte(Debian:14) | All versions | No fix listed |
| debian/vte(Debian:14) | = 1:0.28.2-7 | No fix listed |
References
- Debian Security Tracker CVE-2005-0023 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org exploit
- bugzilla.gnome.org
- 20051007 gnome-pty-helper writes arbitrary utmp records mailing-list
- 17023 third-party-advisory vendor-advisory
- 15004 exploit vdb-entry
- ADV-2005-1931 vdb-entry
- libzvt-gnomeptyhelper-spoof(22496) vdb-entry