Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38     allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries     that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as     getaddrinfo).(CVE-2025-4802)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10219 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:10220 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8686 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9336 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20375 advisory.

    - CVE-2025-4802: static setuid dlopen may search LD_LIBRARY_PATH (RHEL-92685)
    - CVE-2025-0395: Fix a buffer overflow in assert (RHEL-83306)
    - CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34264)
    - CVE-2024-33600: nscd: null pointer dereferences in netgroup cache (RHEL-34267)
    - CVE-2024-33601: nscd: crash on out-of-memory condition (RHEL-34271)
    - CVE-2024-33602: nscd: memory corruption with NSS netgroup modules (RHEL-34273)
    - CVE-2024-2961: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (RHEL-31804)
    - CVE-2023-4911 glibc: buffer overflow in ld.so leading to privilege escalation (RHEL-3036)
    - CVE-2023-4806 glibc: potential use-after-free in getaddrinfo (RHEL-2423)
    - CVE-2023-4813: Work around RHEL-8 limitation in test (RHEL-2435)
    - CVE-2023-4813: potential use-after-free in gaih_inet (RHEL-2435)
    - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaaa mode (#2234714)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8655 advisory.

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1001 advisory.

    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38     allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries     that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as     getaddrinfo). (CVE-2025-4802)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8686 advisory.

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8686 advisory.

    - CVE-2025-4802: static setuid dlopen may search LD_LIBRARY_PATH (RHEL-92685)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8655 advisory.

    [2.34-168.0.1.19]
    - Forward-port Oracle patches for ol9-u6       Reviewed-by: David Faust <david.faust@oracle.com>       Oracle history:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8655 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01702-2 advisory.

    - CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries     using dlopen       search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01784-1 advisory.

    Security issues fixed:

    - CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries     using dlopen       search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

    Other issues fixed:

    - Multi-threaded application hang due to deadlock when `pthread_cond_signal` fails to wake up     `pthread_cond_wait`       as a consequence of a bug related to stealing of signals (bsc#1234128).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7541-1 advisory.

    It was discovered that the GNU C Library incorrectly search LD_LIBRARY_PATH to determine which library to     load when statically linked setuid binary calls dlopen. A local attacker could possibly use this issue to     cause a denial of service or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4181 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4181-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     May 27, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : glibc     Version        : 2.31-13+deb11u13     CVE ID         : CVE-2025-4802

    A flaw was discovered in the dynamic linking support in the GNU C     Library, the C standard library implementation used by Debian.

    Privilege escalation may be possible in statically compiled setuid     binaries that call dlopen(), due to an untrusted LD_LIBRARY_PATH     environment variable vulnerability.  This includes calls to dlopen()     internal to glibc itself, made after user calls to setlocale() or to NSS     functions such as getaddrinfo().

    For Debian 11 bullseye, this problem has been fixed in version     2.31-13+deb11u13.

    We recommend that you upgrade your glibc packages.

    For the detailed security status of glibc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/glibc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01702-1 advisory.

    - CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries     using dlopen       search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of aaa_glibc-solibs installed on the remote host is prior to 2.33. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-140-01 advisory.

    New glibc packages are available for Slackware 15.0 to fix a security issue.

Tenable has extracted the preceding description block directly from the aaa_glibc-solibs security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
241816	EulerOS 2.0 SP10 : glibc (EulerOS-SA-2025-1797)	Nessus	Huawei Local Security Checks	high
241791	EulerOS 2.0 SP10 : glibc (EulerOS-SA-2025-1774)	Nessus	Huawei Local Security Checks	high
241214	RHEL 7 : glibc (RHSA-2025:10219)	Nessus	Red Hat Local Security Checks	high
241201	RHEL 7 : glibc (RHSA-2025:10220)	Nessus	Red Hat Local Security Checks	high
240682	RHEL 8 : glibc (RHSA-2025:8686)	Nessus	Red Hat Local Security Checks	high
240243	RHEL 9 : glibc (RHSA-2025:9336)	Nessus	Red Hat Local Security Checks	high
240152	Oracle Linux 8 : glibc (ELSA-2025-20375)	Nessus	Oracle Linux Local Security Checks	high
238343	AlmaLinux 9 : glibc (ALSA-2025:8655)	Nessus	Alma Linux Local Security Checks	high
238275	Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-1001)	Nessus	Amazon Linux Local Security Checks	high
238245	AlmaLinux 8 : glibc (ALSA-2025:8686)	Nessus	Alma Linux Local Security Checks	high
238234	Oracle Linux 8 : glibc (ELSA-2025-8686)	Nessus	Oracle Linux Local Security Checks	high
238037	Oracle Linux 9 : glibc (ELSA-2025-8655)	Nessus	Oracle Linux Local Security Checks	high
237980	RHEL 9 : glibc (RHSA-2025:8655)	Nessus	Red Hat Local Security Checks	high
237779	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2025:01702-2)	Nessus	SuSE Local Security Checks	high
237606	SUSE SLES15 Security Update : glibc (SUSE-SU-2025:01784-1)	Nessus	SuSE Local Security Checks	high
237431	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : GNU C Library vulnerability (USN-7541-1)	Nessus	Ubuntu Local Security Checks	high
237337	Debian dla-4181 : glibc-doc - security update	Nessus	Debian Local Security Checks	high
237287	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2025:01702-1)	Nessus	SuSE Local Security Checks	high
237117	Slackware Linux 15.0 aaa_glibc-solibs Vulnerability (SSA:2025-140-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2025-4802

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high