| Package | Affected versions | Patched versions |
|---|---|---|
| festival | = 1.4.1= 1.4.2= 1.4.3= 1.95= 1.96≤ 2.0.95 |
festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free