envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows lo

Summary

envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.

Timeline

1. Apr 18, 2012, 10:00 AM UTCCVE published
2. Aug 6, 2024, 6:38 PM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

References 23