CVE-2008-5986
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse…
Does this matter?
Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.
Description
Untrusted search path vulnerability in the (1) "VST plugin with Python scripting" and (2) "VST plugin for writing score generators in Python" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 0.36% probability · 30th percentile
- CISA KEV
- Not listed
- Affected
- csound/csound
- Source
- cve@mitre.org
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359
- http://www.openwall.com/lists/oss-security/2009/01/26/2
- http://www.securityfocus.com/bid/33446
- https://bugzilla.redhat.com/show_bug.cgi?id=481550
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48276
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359
- http://www.openwall.com/lists/oss-security/2009/01/26/2
- http://www.securityfocus.com/bid/33446
- https://bugzilla.redhat.com/show_bug.cgi?id=481550
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48276
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.