festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016710 advisory.

    festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and     earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain     privileges via a Trojan horse shared library in the current working directory.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

festival_server uses an unsafe LD_LIBRARY_PATH. Local users could exploit that to execute code as another user if that user runs festival_server. CVE-2010-3996 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201312-06 (Festival: Arbitrary code execution)

    A vulnerability in Festival Server has an incorrect path in       LD_LIBRARY_PATH, which allows local users to place a Trojan horse shared       library in the current working directory.
  Impact :

    A local attacker can execute arbitrary a Trojan horse shared library,       potentially resulting in arbitrary code execution and privilege       escalation.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
316231	Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: festival (UTSA-2026-016710)	Nessus	Unity Linux Local Security Checks	Local	high
75487	openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)	Nessus	SuSE Local Security Checks	Local	medium
71258	GLSA-201312-06 : Festival: Arbitrary code execution	Nessus	Gentoo Local Security Checks	Local	medium
50317	openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)	Nessus	SuSE Local Security Checks	Local	medium
50316	openSUSE Security Update : festival (openSUSE-SU-2010:0756-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2010-3996

high

Tenable Plugins

high

medium

medium

medium

medium