CVE-2019-20373: Debian Linux

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Ltsp Ldm: up to and including 2.18.06

Published 2020-01-09. Last modified 2026-06-17.