{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-11-02T00:00:00", "descriptions": [{"lang": "en", "value": "Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-07T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "33446", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/33446"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=481550"}, {"name": "csound-pysyssetargv-privilege-escalation(48276)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"}, {"name": "[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-5986", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "33446", "refsource": "BID", "url": "http://www.securityfocus.com/bid/33446"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=481550", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=481550"}, {"name": "csound-pysyssetargv-privilege-escalation(48276)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"}, {"name": "[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T11:13:13.931Z"}, "title": "CVE Program Container", "references": [{"name": "33446", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/33446"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=481550"}, {"name": "csound-pysyssetargv-privilege-escalation(48276)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"}, {"name": "[oss-security] 20090126 CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-5986", "datePublished": "2009-01-28T11:00:00", "dateReserved": "2009-01-27T00:00:00", "dateUpdated": "2024-08-07T11:13:13.931Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:csound:csound:5.08.2:*:*:*:*:*:*:*", "matchCriteriaId": "CD401A94-40BB-45A8-A702-DE8710FD0A71", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983)."}, {"lang": "es", "value": "Vulnerabilidad de ruta de b\u00fasqueda no confiable en (1) \"Extensi\u00f3n VST con secuencias de comandos Python\" y (2) \"Extensi\u00f3n VST para escribir generadores de puntuaciones en Python\" en Csound v5.08.2 y puede que otras versiones; permite a usuarios locales ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un fichero Python con un caballo de troya en el directorio de trabajo actual. Est\u00e1 relacionado con la vulnerabilidad en la funci\u00f3n PySys_SetArgv (CVE-2008-5983)."}], "id": "CVE-2008-5986", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-01-28T11:30:00.217", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/33446"}, {"source": "cve@mitre.org", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=481550"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504359"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/33446"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=481550"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48276"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "csound: untrusted python modules search path", "id": "481550", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=481550"}, "csaw": false, "details": ["Untrusted search path vulnerability in the (1) \"VST plugin with Python scripting\" and (2) \"VST plugin for writing score generators in Python\" in Csound 5.08.2, and possibly other versions, allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983)."], "name": "CVE-2008-5986", "public_date": "2008-11-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2008-5986"], "threat_severity": "Low"}