CVE-2011-0532: Fedoraproject 389 Directory Server

Medium severity, CVSS 6.2. EPSS: 0.3% chance of exploitation in the next 30 days.

The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

Affected products

• Fedoraproject 389 Directory Server: version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.5 only; version 1.2.6 only; version 1.2.6.1 only; …
• Red Hat Directory Server: version 8.2 only; version 8.2.3 only

Published 2011-02-23. Last modified 2026-06-16.