CVE-2016-10151
hesiod: The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configura...
CVE-2016-10151 is fixed in 2 products on 1 platform, first by hesiod 3.2.1-3.1~build0.18.04.1, released March 28, 2017. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0039
33rd percentile
The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| hesiod · Ubuntu 18.04.6 LTS (bionic) | 3.2.1-3.1~build0.18.04.1 | hesiod 3.2.1-3.1~build0.18.04.1 | Mar 28, 2017 |
| libhesiod0 · Ubuntu 18.04.6 LTS (bionic) | 3.2.1-3.1~build0.18.04.1 | libhesiod0 3.2.1-3.1~build0.18.04.1 | Mar 28, 2017 |