CVE-2010-3359: Debian Linux

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Gargoyle Project Gargoyle: before 2009-08-25 (fixed in 2009-08-25)

Published 2019-11-12. Last modified 2026-06-16.