CVE-2010-4039: Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors

Critical severity · published Oct 21, 2010

CVE-2010-4039

Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors

9.8

CVSS

1.3%

EPSS

On KEV

Description

Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.3% · higher than 71% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Chrome · Google

before 7.0.517.41 · source: NVD

Affected product

Chrome

Google

All Chrome CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2010-4039

CVE.org

https://www.cve.org/CVERecord?id=CVE-2010-4039

Issue Tracking

http://code.google.com/p/chromium/issues/detail?id=54132

Release Notes

http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html

Not Applicable

http://secunia.com/advisories/41888

Third Party Advisory

http://www.securityfocus.com/bid/44241

Not Applicable

http://www.vupen.com/english/advisories/2010/2731

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14223