The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoni…
CVSS 3.0CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.0683·Published 2017-03-28·Will not fixCWE-264
The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG…
CVSS 3.0HIGH 7.0·Local·Low privileges·No interaction·EPSS 0.00391·Published 2017-03-01·Will not fixCWE-264
