glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH

🗓️ 09 Jun 2025 14:48:41Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 7 Views

GNU C library flaw allows static set user id binaries using dlopen to load libraries.

Reporter	Title	Published	Views	Family All 187
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway potentially vulnerable to library path manipulation	22 Dec 202514:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak	8 Nov 202516:02	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to untrusted library loading due to the GNU C library (CVE-2025-4802)	4 Sep 202522:45	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities due to libxml2, python3, pam and glibc packages shipped with IBM CICS TX Standard.	12 Aug 202511:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	3 Jul 202510:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System	3 Jul 202623:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	23 Jul 202517:22	–	ibm
Tenable Nessus	Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2025-1001)	12 Jun 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0138: glibc (ALINUX3-SA-2025:0138)	19 Aug 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : glibc (ALSA-2025:8655)	12 Jun 202500:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	compat-libpthread-nonshared	0:2.28-251.el8_10.22	compat-libpthread-nonshared-0:2.28-251.el8_10.22.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	compat-libpthread-nonshared	0:2.28-251.el8_10.22	compat-libpthread-nonshared-0:2.28-251.el8_10.22.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	compat-libpthread-nonshared	0:2.28-251.el8_10.22	compat-libpthread-nonshared-0:2.28-251.el8_10.22.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	compat-libpthread-nonshared	0:2.28-251.el8_10.22	compat-libpthread-nonshared-0:2.28-251.el8_10.22.x86_64.rpm
Red Hat Enterprise Linux	8	aarch64	glibc	0:2.28-251.el8_10.22	glibc-0:2.28-251.el8_10.22.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	glibc	0:2.28-251.el8_10.22	glibc-0:2.28-251.el8_10.22.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	glibc	0:2.28-251.el8_10.22	glibc-0:2.28-251.el8_10.22.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	glibc	0:2.28-251.el8_10.22	glibc-0:2.28-251.el8_10.22.x86_64.rpm
Red Hat Enterprise Linux	8	any	glibc	0:2.28-251.el8_10.22.i686	glibc-0:2.28-251.el8_10.22.i686.noarch.rpm
Red Hat Enterprise Linux	8	aarch64	glibc-all-langpacks	0:2.28-251.el8_10.22	glibc-all-langpacks-0:2.28-251.el8_10.22.aarch64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-4802
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
inbox	www.inbox.sourceware.org/libc-announce/[email protected]/T/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-4802
sourceware	www.sourceware.org/bugzilla/show_bug.cgi
cve	www.cve.org/CVERecord
openwall	www.openwall.com/lists/oss-security/2025/05/16/7
openwall	www.openwall.com/lists/oss-security/2025/05/17/2

28 Jun 2026 12:11Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.8

EPSS0.00557

SSVC

c library flaw static binaries set user id dlopen usage library loading privilege escalation