Skip to content
Threat Feed
Subscribe

Product

Libextractor (< 1.16)

1 brief RSS
high advisory

Arbitrary Code Execution in GNU libextractor via Environment Variable Injection

GNU libextractor versions prior to 1.16 are vulnerable to arbitrary code execution due to the insecure handling of the LIBEXTRACTOR_PREFIX environment variable, which can be leveraged by local attackers for privilege escalation.

libextractor privilege-escalation linux vulnerability
1t 1c