CVE-2009-0318 Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory,....
MediumCVSS 6.9
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME gnumeric | All versions | No fix listed |
| debian/gnumeric(Debian:12) | < 1.8.4-3 | 1.8.4-3 |
| debian/gnumeric(Debian:13) | < 1.8.4-3 | 1.8.4-3 |
| debian/gnumeric(Debian:14) | < 1.8.4-3 | 1.8.4-3 |
References
- bugzilla.gnome.org
- 33707 third-party-advisory
- 33823 third-party-advisory
- GLSA-200904-03 vendor-advisory
- MDVSA-2009:043 vendor-advisory
- [oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric) mailing-list
- 33438 vdb-entry
- bugzilla.redhat.com
- FEDORA-2009-1295 vendor-advisory
- Debian Security Tracker CVE-2009-0318 vendor-advisory
- bugs.debian.org issue-tracking