CVEvulnerability

CVE-2008-4865

7.2 HIGH Published 2008-11-01 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-11-01
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.

Affected configurations

• valgrind valgrind (<= 3.4.0) • valgrind valgrind 1.9.6 • valgrind valgrind 2.0.0 • valgrind valgrind 2.1.0 • valgrind valgrind 2.1.1 • valgrind valgrind 2.2.0 • valgrind valgrind 2.4.1 • valgrind valgrind 3.0.0 • valgrind valgrind 3.0.1 • valgrind valgrind 3.1.0 • valgrind valgrind 3.1.1 • valgrind valgrind 3.2.0 • valgrind valgrind 3.2.1 • valgrind valgrind 3.2.2 • valgrind valgrind 3.2.3 • valgrind valgrind 3.3.0 • valgrind valgrind 3.3.1

References