Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0027 advisory.

    - Resolves: CVE-2010-1634 CVE-2010-2089
    - Related: CVE-2008-5983
    - Rework rgbimgmodule fix for CVE-2008-3143
    - Resolves: rhbz#644425 CVE-2009-4134 CVE-2010-1449 CVE-2010-1450

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities:

  - Multiple integer overflows in the imageop module in     Python 2.5.1 and earlier allow context-dependent     attackers to cause a denial of service (application     crash) and possibly obtain sensitive information (memory     contents) via crafted arguments to (1) the tovideo     method, and unspecified other vectors related to (2)     imageop.c, (3) rbgimgmodule.c, and other files, which     trigger heap-based buffer overflows. (CVE-2007-4965)

  - Integer overflow in _hashopenssl.c in the hashlib module     in Python 2.5.2 and earlier might allow context-     dependent attackers to defeat cryptographic digests,     related to partial hashlib hashing of data exceeding     4GB. (CVE-2008-2316)

  - Untrusted search path vulnerability in the PySys_SetArgv     API function in Python 2.6 and earlier, and possibly     later versions, prepends an empty string to sys.path     when the argv[0] argument does not contain a path     separator, which might allow local users to execute     arbitrary code via a Trojan horse Python file in the     current working directory. (CVE-2008-5983)

  - Multiple integer overflows in audioop.c in the audioop     module in Python 2.6, 2.7, 3.1, and 3.2 allow context-     dependent attackers to cause a denial of service     (application crash) via a large fragment, as     demonstrated by a call to audioop.lin2lin with a long     string in the first argument, leading to a buffer     overflow. NOTE: this vulnerability exists because of an     incorrect fix for CVE-2008-3143.5. (CVE-2010-1634)

  - The audioop module in Python 2.7 and 3.2 does not verify     the relationships between size arguments and byte string     lengths, which allows context-dependent attackers to     cause a denial of service (memory corruption and     application crash) via crafted arguments, as     demonstrated by a call to audioop.reverse with a one-     byte string, a different vulnerability than     CVE-2010-1634. (CVE-2010-2089)

  - The ssl.match_hostname function in the SSL module in     Python 2.6 through 3.4 does not properly handle a '\0'     character in a domain name in the Subject Alternative     Name field of an X.509 certificate, which allows man-in-     the-middle attackers to spoof arbitrary SSL servers via     a crafted certificate issued by a legitimate     Certification Authority, a related issue to     CVE-2009-2408. (CVE-2013-4238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. This issue only affected Ubuntu 10.04 LTS.
(CVE-2008-5983)

It was discovered that the audioop module did not correctly perform input validation. If a user or automated system were tricked into opening a crafted audio file, an attacker could cause a denial of service via application crash. These issues only affected Ubuntu 10.04 LTS. (CVE-2010-1634, CVE-2010-2089)

It was discovered that Python distutils contained a race condition when creating the ~/.pypirc file. A local attacker could exploit this to obtain sensitive information. (CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did not properly validate its input when handling HTTP POST requests. A remote attacker could exploit this to cause a denial of service via excessive CPU utilization. (CVE-2012-0845)

It was discovered that Python was susceptible to hash algorithm attacks. An attacker could cause a denial of service under certian circumstances. This update adds the '-R' command line option and honors setting the PYTHONHASHSEED environment variable to 'random' to salt str and datetime objects with an unpredictable value.
(CVE-2012-1150)

Serhiy Storchaka discovered that the UTF16 decoder in Python did not properly reset internal variables after error handling. An attacker could exploit this to cause a denial of service via memory corruption.
(CVE-2012-2135).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1613-1 fixed vulnerabilities in Python 2.5. This update provides the corresponding updates for Python 2.4.

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. (CVE-2008-5983)

It was discovered that the audioop module did not correctly perform input validation. If a user or automated system were tricked into opening a crafted audio file, an attacker could cause a denial of service via application crash.
(CVE-2010-1634, CVE-2010-2089)

Giampaolo Rodola discovered several race conditions in the smtpd module. A remote attacker could exploit this to cause a denial of service via daemon outage. (CVE-2010-3493)

It was discovered that the CGIHTTPServer module did not properly perform input validation on certain HTTP GET requests. A remote attacker could potentially obtain access to CGI script source files. (CVE-2011-1015)

Niels Heinen discovered that the urllib and urllib2 modules would process Location headers that specify a redirection to file: URLs. A remote attacker could exploit this to obtain sensitive information or cause a denial of service.
(CVE-2011-1521)

It was discovered that SimpleHTTPServer did not use a charset parameter in the Content-Type HTTP header. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 users. (CVE-2011-4940)

It was discovered that Python distutils contained a race condition when creating the ~/.pypirc file. A local attacker could exploit this to obtain sensitive information.
(CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did not properly validate its input when handling HTTP POST requests. A remote attacker could exploit this to cause a denial of service via excessive CPU utilization. (CVE-2012-0845)

It was discovered that the Expat module in Python 2.5 computed hash values without restricting the ability to trigger hash collisions predictably. If a user or application using pyexpat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive CPU resources.
(CVE-2012-0876)

Tim Boddy discovered that the Expat module in Python 2.5 did not properly handle memory reallocation when processing XML files. If a user or application using pyexpat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory resources.
(CVE-2012-1148).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. (CVE-2008-5983)

It was discovered that the audioop module did not correctly perform input validation. If a user or automated system were tricked into opening a crafted audio file, an attacker could cause a denial of service via application crash. (CVE-2010-1634, CVE-2010-2089)

Giampaolo Rodola discovered several race conditions in the smtpd module. A remote attacker could exploit this to cause a denial of service via daemon outage. (CVE-2010-3493)

It was discovered that the CGIHTTPServer module did not properly perform input validation on certain HTTP GET requests. A remote attacker could potentially obtain access to CGI script source files.
(CVE-2011-1015)

Niels Heinen discovered that the urllib and urllib2 modules would process Location headers that specify a redirection to file: URLs. A remote attacker could exploit this to obtain sensitive information or cause a denial of service. (CVE-2011-1521)

It was discovered that SimpleHTTPServer did not use a charset parameter in the Content-Type HTTP header. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 users. (CVE-2011-4940)

It was discovered that Python distutils contained a race condition when creating the ~/.pypirc file. A local attacker could exploit this to obtain sensitive information. (CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did not properly validate its input when handling HTTP POST requests. A remote attacker could exploit this to cause a denial of service via excessive CPU utilization. (CVE-2012-0845)

It was discovered that the Expat module in Python 2.5 computed hash values without restricting the ability to trigger hash collisions predictably. If a user or application using pyexpat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive CPU resources. (CVE-2012-0876)

Tim Boddy discovered that the Expat module in Python 2.5 did not properly handle memory reallocation when processing XML files. If a user or application using pyexpat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory resources. (CVE-2012-1148).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. (CVE-2008-5983)

It was discovered that the audioop module did not correctly perform input validation. If a user or automated system were tricked into opening a crafted audio file, an attacker could cause a denial of service via application crash. (CVE-2010-1634, CVE-2010-2089)

Giampaolo Rodola discovered several race conditions in the smtpd module. A remote attacker could exploit this to cause a denial of service via daemon outage. (CVE-2010-3493)

It was discovered that the CGIHTTPServer module did not properly perform input validation on certain HTTP GET requests. A remote attacker could potentially obtain access to CGI script source files.
(CVE-2011-1015)

Niels Heinen discovered that the urllib and urllib2 modules would process Location headers that specify a redirection to file: URLs. A remote attacker could exploit this to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 11.04.
(CVE-2011-1521)

It was discovered that SimpleHTTPServer did not use a charset parameter in the Content-Type HTTP header. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 users. This issue only affected Ubuntu 11.04. (CVE-2011-4940)

It was discovered that Python distutils contained a race condition when creating the ~/.pypirc file. A local attacker could exploit this to obtain sensitive information. (CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did not properly validate its input when handling HTTP POST requests. A remote attacker could exploit this to cause a denial of service via excessive CPU utilization. (CVE-2012-0845)

It was discovered that Python was susceptible to hash algorithm attacks. An attacker could cause a denial of service under certian circumstances. This update adds the '-R' command line option and honors setting the PYTHONHASHSEED environment variable to 'random' to salt str and datetime objects with an unpredictable value.
(CVE-2012-1150).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that many applications embedding the Python interpreter did not specify a valid full path to the script or application when calling the PySys_SetArgv API function, which could result in the addition of the current working directory to the module search path (sys.path). A local attacker able to trick a victim into running such an application in an attacker-controlled directory could use this flaw to execute code with the victim's privileges. This update adds the PySys_SetArgvEx API. Developers can modify their applications to use this new API, which sets sys.argv without modifying sys.path.
(CVE-2008-5983)

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2009-4134, CVE-2010-1449, CVE-2010-1450)

Multiple flaws were found in the Python audioop module. Supplying certain inputs could cause the audioop module to crash or, possibly, execute arbitrary code. (CVE-2010-1634, CVE-2010-2089)

This update also fixes the following bugs :

  - When starting a child process from the subprocess module     in Python 2.4, the parent process could leak file     descriptors if an error occurred. This update resolves     the issue. (BZ#609017)

  - Prior to Python 2.7, programs that used 'ulimit -n' to     enable communication with large numbers of subprocesses     could still monitor only 1024 file descriptors at a     time, which caused an exception :

    ValueError: filedescriptor out of range in select()

This was due to the subprocess module using the 'select' system call.
The module now uses the 'poll' system call, removing this limitation.
(BZ#609020)

  - Prior to Python 2.5, the tarfile module failed to unpack     tar files if the path was longer than 100 characters.
    This update backports the tarfile module from Python 2.5     and the issue no longer occurs. (BZ#263401)

  - The email module incorrectly implemented the logic for     obtaining attachment file names: the get_filename()     fallback for using the deprecated 'name' parameter of     the 'Content-Type' header erroneously used the     'Content-Disposition' header. This update backports a     fix from Python 2.6, which resolves this issue.
    (BZ#644147)

  - Prior to version 2.5, Python's optimized memory     allocator never released memory back to the system. The     memory usage of a long-running Python process would     resemble a 'high-water mark'. This update backports a     fix from Python 2.5a1, which frees unused arenas, and     adds a non-standard sys._debugmallocstats() function,     which prints diagnostic information to stderr. Finally,     when running under Valgrind, the optimized allocator is     deactivated, to allow more convenient debugging of     Python memory usage issues. (BZ#569093)

  - The urllib and urllib2 modules ignored the no_proxy     variable, which could lead to programs such as 'yum'     erroneously accessing a proxy server for URLs covered by     a 'no_proxy' exclusion. This update backports fixes of     urllib and urllib2, which respect the 'no_proxy'     variable, which fixes these issues. (BZ#549372)

As well, this update adds the following enhancements :

  - This update introduces a new python-libs package,     subsuming the majority of the content of the core python     package. This makes both 32-bit and 64-bit Python     libraries available on PowerPC systems. (BZ#625372)

  - The python-libs.i386 package is now available for 64-bit     Itanium with the 32-bit Itanium compatibility mode.
    (BZ#644761)

Updated python packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Python is an interpreted, interactive, object-oriented programming language.

It was found that many applications embedding the Python interpreter did not specify a valid full path to the script or application when calling the PySys_SetArgv API function, which could result in the addition of the current working directory to the module search path (sys.path). A local attacker able to trick a victim into running such an application in an attacker-controlled directory could use this flaw to execute code with the victim's privileges. This update adds the PySys_SetArgvEx API. Developers can modify their applications to use this new API, which sets sys.argv without modifying sys.path.
(CVE-2008-5983)

Multiple flaws were found in the Python rgbimg module. If an application written in Python was using the rgbimg module and loaded a specially crafted SGI image file, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2009-4134, CVE-2010-1449, CVE-2010-1450)

Multiple flaws were found in the Python audioop module. Supplying certain inputs could cause the audioop module to crash or, possibly, execute arbitrary code. (CVE-2010-1634, CVE-2010-2089)

This update also fixes the following bugs :

* When starting a child process from the subprocess module in Python 2.4, the parent process could leak file descriptors if an error occurred. This update resolves the issue. (BZ#609017)

* Prior to Python 2.7, programs that used 'ulimit -n' to enable communication with large numbers of subprocesses could still monitor only 1024 file descriptors at a time, which caused an exception :

ValueError: filedescriptor out of range in select()

This was due to the subprocess module using the 'select' system call.
The module now uses the 'poll' system call, removing this limitation.
(BZ#609020)

* Prior to Python 2.5, the tarfile module failed to unpack tar files if the path was longer than 100 characters. This update backports the tarfile module from Python 2.5 and the issue no longer occurs.
(BZ#263401)

* The email module incorrectly implemented the logic for obtaining attachment file names: the get_filename() fallback for using the deprecated 'name' parameter of the 'Content-Type' header erroneously used the 'Content-Disposition' header. This update backports a fix from Python 2.6, which resolves this issue. (BZ#644147)

* Prior to version 2.5, Python's optimized memory allocator never released memory back to the system. The memory usage of a long-running Python process would resemble a 'high-water mark'. This update backports a fix from Python 2.5a1, which frees unused arenas, and adds a non-standard sys._debugmallocstats() function, which prints diagnostic information to stderr. Finally, when running under Valgrind, the optimized allocator is deactivated, to allow more convenient debugging of Python memory usage issues. (BZ#569093)

* The urllib and urllib2 modules ignored the no_proxy variable, which could lead to programs such as 'yum' erroneously accessing a proxy server for URLs covered by a 'no_proxy' exclusion. This update backports fixes of urllib and urllib2, which respect the 'no_proxy' variable, which fixes these issues. (BZ#549372)

As well, this update adds the following enhancements :

* This update introduces a new python-libs package, subsuming the majority of the content of the core python package. This makes both 32-bit and 64-bit Python libraries available on PowerPC systems.
(BZ#625372)

* The python-libs.i386 package is now available for 64-bit Itanium with the 32-bit Itanium compatibility mode. (BZ#644761)

All Python users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

- Backport from F14: - Fix for lone surrogates, utf8 and     certain encode error handlers. - Fix an incompatibility     between pyexpat and the system expat-2.0.1 that led to a     segfault running test_pyexpat.py (patch 110; upstream     issue 9054; rhbz#610312)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jun 4 2010 David Malcolm <dmalcolm at redhat.com> -     2.6.2-8

    - ensure that the compiler is invoked with '-fwrapv'       (rhbz#594819)

    - CVE-2010-1634: fix various integer overflow checks in       the audioop module (patch 113)

  - CVE-2010-2089: further checks within the audioop module     (patch 114)

    - CVE-2008-5983: the new PySys_SetArgvEx entry point       from r81399 (patch 115)

    - Fri Mar 12 2010 David Malcolm <dmalcolm at redhat.com>
      - 2.6.2-7

    - document all patches, and remove the commented-out       ones

    - Address some of the issues identified in package       review (bug 226342) :

    - update libs requirement on base package to use %{name}       for consistency's sake

  - convert from backticks to $() syntax throughout

    - wrap value of LD_LIBRARY_PATH in quotes

    - convert '/usr/bin/find' requirement to 'findutils'

    - remove trailing periods from summaries of subpackages

    - fix spelling mistake in description of -test       subpackage

    - convert usage of $$RPM_BUILD_ROOT to %{buildroot}       throughout, for stylistic consistency

  - supply dirmode arguments to defattr directives

    - replace references to /usr with %{_prefix}; replace       references to /usr/include with %{_includedir}

  - fixup the build when __python_ver is set (Zach Sadecki;
    bug 533989); use pybasever in the files section

  - Mon Jan 25 2010 David Malcolm <dmalcolm at redhat.com> -     2.6.2-6

    - update python-2.6.2-config.patch to remove downstream       customization of build of pyexpat and elementtree       modules

  - add patch adapted from upstream (patch 3) to add support     for building against system expat; add
    --with-system-expat to 'configure' invocation (patch 3)

  - remove embedded copy of expat from source tree during     'prep'

    - Mon Jan 25 2010 David Malcolm <dmalcolm at redhat.com>
      - 2.6.2-5

    - replace 'define' with 'global' throughout

    - introduce macros for 3 directories, replacing expanded       references throughout: %{pylibdir}, %{dynload_dir},       %{site_packages}

  - explicitly list all lib-dynload files, rather than     dynamically gathering the payload into a temporary text     file, so that we can be sure what we are shipping;
    remove now-redundant testing for presence of certain .so     files

  - remove embedded copy of libffi and zlib from source tree     before building

    - Mon Jan 25 2010 David Malcolm <dmalcolm at redhat.com>
      - 2.6.2-4

    - change python-2.6.2-config.patch to remove our       downstream change to curses configuration in       Modules/Setup.dist, so that the curses modules are       built using setup.py with the downstream default       (linking against libncursesw.so, rather than       libncurses.so), rather than within the Makefile; add a       test to %install to verify the dso files that the       curses module is linked against the correct DSO (bug       539917; changes _cursesmodule.so -> _curses.so)

  - Fri Jan 8 2010 David Malcolm <dmalcolm at redhat.com> -     2.6.2-3

    - fix Lib/SocketServer.py to avoid trying to use       non-existent keyword args for os.waitpid (patch 52,       rhbz:552404, Adrian Reber)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jun 4 2010 David Malcolm <dmalcolm at redhat.com> -     2.6.4-27

    - ensure that the compiler is invoked with '-fwrapv'       (rhbz#594819)

    - CVE-2010-1634: fix various integer overflow checks in       the audioop module (patch 113)

  - CVE-2010-2089: further checks within the audioop module     (patch 114)

    - CVE-2008-5983: the new PySys_SetArgvEx entry point       from r81399 (patch 115)

    - Mon Apr 26 2010 Dennis Gilmore <dennis at ausil.us> -       2.6.4-26

    - disable --with-valgrind on sparc arches

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200904-06 (Eye of GNOME: Untrusted search path)

    James Vega reported an untrusted search path vulnerability in the     GObject Python interpreter wrapper in the Eye of GNOME, a vulnerabiliy     related to CVE-2008-5983.
  Impact :

    A local attacker could entice a user to run the Eye of GNOME from a     directory containing a specially crafted python module, resulting in     the execution of arbitrary code with the privileges of the user running     the application.
  Workaround :

    Do not run 'eog' from untrusted working directories.

The remote host is affected by the vulnerability described in GLSA-200903-41 (gedit: Untrusted search path)

    James Vega reported that gedit uses the current working directory when     searching for python modules, a vulnerability related to CVE-2008-5983.
  Impact :

    A local attacker could entice a user to open gedit from a specially     crafted environment, possibly resulting in the execution of arbitrary     code with the privileges of the user running the application.
  Workaround :

    Do not run gedit from untrusted working directories.

CVE Mitre reports :

Untrusted search path vulnerability in the Python interface in Epiphany 2.22.3, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).

- Fri Jan 30 2009 Huzaifa Sidhpurwala <huzaifas at     redhat.com> 1:1.8.2-4

    - Resolves CVE-2009-5983

    - Version Bump

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181052	Oracle Linux 5 : python (ELSA-2011-0027)	Nessus	Oracle Linux Local Security Checks	critical
127154	NewStart CGSL MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2019-0008)	Nessus	NewStart CGSL Local Security Checks	high
62700	Ubuntu 10.04 LTS / 11.04 : python3.1 vulnerabilities (USN-1616-1)	Nessus	Ubuntu Local Security Checks	medium
62620	Ubuntu 8.04 LTS : python2.4 vulnerabilities (USN-1613-2)	Nessus	Ubuntu Local Security Checks	medium
62619	Ubuntu 8.04 LTS : python2.5 vulnerabilities (USN-1613-1)	Nessus	Ubuntu Local Security Checks	medium
62436	Ubuntu 10.04 LTS / 11.04 / 11.10 : python2.6 vulnerabilities (USN-1596-1)	Nessus	Ubuntu Local Security Checks	medium
60935	Scientific Linux Security Update : python on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51524	RHEL 5 : python (RHSA-2011:0027)	Nessus	Red Hat Local Security Checks	high
49107	Fedora 13 : python3-3.1.2-7.fc13 (2010-13388)	Nessus	Fedora Local Security Checks	medium
47600	Fedora 12 : python-2.6.2-8.fc12 (2010-9565)	Nessus	Fedora Local Security Checks	medium
47547	Fedora 13 : python-2.6.4-27.fc13 (2010-9652)	Nessus	Fedora Local Security Checks	medium
36094	GLSA-200904-06 : Eye of GNOME: Untrusted search path	Nessus	Gentoo Local Security Checks	medium
36055	GLSA-200903-41 : gedit: Untrusted search path	Nessus	Gentoo Local Security Checks	medium
35910	FreeBSD : epiphany -- untrusted search path vulnerability (e848a92f-0e7d-11de-92de-000bcdc1757a)	Nessus	FreeBSD Local Security Checks	medium
35596	Fedora 9 : gnumeric-1.8.2-4.fc9 (2009-1295)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-5983

high

Tenable Plugins

critical

high

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium