This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GNU glibc fixes a high-severity vulnerability
GNU version 2.39 fixes a high-severity vulnerability in glibc [1]. Among operating systems, only Debian has so far provided a fix, for the trixie release in version 2.41-7 and sid in version 2.41-8 [2].
An unauthenticated local attacker can load an attacker-controlled library and potentially execute code due to improper handling of the LD_LIBRARY_PATH environment variable in selected statically linked setuid programs that call the dlopen function (for example indirectly via setlocale or Name Service Switch functions such as getaddrinfo). Exploiting the vulnerability requires a specific type of program, which had not been identified at the time of disclosure, although its existence cannot be ruled out [1].
The vulnerability is present in product:
- glibc; >=2.27, <=2.38
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-4802 at cve.org, NVD
- CWE-426: Untrusted Search Path at cwe.mitre.org
The vulnerability was publicly disclosed 16. 5. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 20. 5. 2025.