Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01702-2 advisory.

    - CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries     using dlopen       search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01784-1 advisory.

    Security issues fixed:

    - CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries     using dlopen       search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

    Other issues fixed:

    - Multi-threaded application hang due to deadlock when `pthread_cond_signal` fails to wake up     `pthread_cond_wait`       as a consequence of a bug related to stealing of signals (bsc#1234128).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7541-1 advisory.

    It was discovered that the GNU C Library incorrectly search LD_LIBRARY_PATH to determine which library to     load when statically linked setuid binary calls dlopen. A local attacker could possibly use this issue to     cause a denial of service or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4181 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4181-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     May 27, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : glibc     Version        : 2.31-13+deb11u13     CVE ID         : CVE-2025-4802

    A flaw was discovered in the dynamic linking support in the GNU C     Library, the C standard library implementation used by Debian.

    Privilege escalation may be possible in statically compiled setuid     binaries that call dlopen(), due to an untrusted LD_LIBRARY_PATH     environment variable vulnerability.  This includes calls to dlopen()     internal to glibc itself, made after user calls to setlocale() or to NSS     functions such as getaddrinfo().

    For Debian 11 bullseye, this problem has been fixed in version     2.31-13+deb11u13.

    We recommend that you upgrade your glibc packages.

    For the detailed security status of glibc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/glibc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01702-1 advisory.

    - CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries     using dlopen       search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of aaa_glibc-solibs installed on the remote host is prior to 2.33. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-140-01 advisory.

    New glibc packages are available for Slackware 15.0 to fix a security issue.

Tenable has extracted the preceding description block directly from the aaa_glibc-solibs security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237779	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2025:01702-2)	Nessus	SuSE Local Security Checks	high
237606	SUSE SLES15 Security Update : glibc (SUSE-SU-2025:01784-1)	Nessus	SuSE Local Security Checks	high
237431	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : GNU C Library vulnerability (USN-7541-1)	Nessus	Ubuntu Local Security Checks	high
237337	Debian dla-4181 : glibc-doc - security update	Nessus	Debian Local Security Checks	high
237287	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2025:01702-1)	Nessus	SuSE Local Security Checks	high
237117	Slackware Linux 15.0 aaa_glibc-solibs Vulnerability (SSA:2025-140-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2025-4802

high

Tenable Plugins

high

high

high

high

high

high