CVE-2009-5064

Publication date 30 March 2011

Last updated 6 August 2026

Ubuntu priority

Low

Why this priority?

Description

ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.

Read the notes from the security team

Status

Package Ubuntu Release Status
glibc 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy
Not affected
6.06 LTS dapper
Not affected
eglibc 10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

mdeslaur

lucid+ debian packages have a fix in debian/patches/all/local-ldd.diff this issue has been disputed by glibc developers

References

Other references

Access our resources on patching vulnerabilities