[Bug dynamic-link/32976] elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=32976

--- Comment #11 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.35/master branch has been updated by Florian Weimer
<fw@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ed10034f003b41d91307ea8ff936735f9624578a

commit ed10034f003b41d91307ea8ff936735f9624578a
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue May 20 19:45:06 2025 +0200

    elf: Test case for bug 32976 (CVE-2025-4802)

    Check that LD_LIBRARY_PATH is ignored for AT_SECURE statically
    linked binaries, using support_capture_subprogram_self_sgid.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit d8f7a79335b0d861c12c42aec94c04cd5bb181e2)

-- 
You are receiving this mail because:
You are on the CC list for the bug.