{
  "schema_version": "1.4.0",
  "id": "GHSA-j6fm-hjr6-8qh9",
  "modified": "2022-05-17T01:18:40Z",
  "published": "2022-05-17T01:18:40Z",
  "aliases": [
    "CVE-2011-4060"
  ],
  "details": "The runtime linker in QNX Neutrino RTOS 6.5.0 before Service Pack 1 does not properly clear the LD_DEBUG_OUTPUT and LD_DEBUG environment variables when a program is spawned from a setuid program, which allows local users to overwrite files via a symlink attack.",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4060"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/8475"
    },
    {
      "type": "WEB",
      "url": "http://www.nth-dimension.org.uk/pub/NDSA20110310.txt.asc"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/71784"
    },
    {
      "type": "WEB",
      "url": "http://www.qnx.com/developers/articles/rel_5189_46.html"
    },
    {
      "type": "WEB",
      "url": "http://www.qnx.com/developers/docs/6.5.0_sp1/index.jsp?topic=%2Fcom.qnx.doc.momentics_release_notes%2Frel_6.5.0_SP1.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/516958"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/518659"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/46838"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-10-18T01:55:00Z"
  }
}