CVE-2009-3894
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain...
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
Exploit likelihood
What each source reports
NVD Score used
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
- Record
CVE-2009-3894- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
- Record
CVE-2009-3894- Updated
- 2026-11-02
EUVDEUVD-2009-3865 No score
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
- Record
EUVD-2009-3865- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c59x-5529-vcp7 No score
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain...
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
- Record
GHSA-c59x-5529-vcp7- Updated
- 2026-11-02
OSV No score
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
- Record
CVE-2009-3894- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3894 No score
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
- Record
DEBIAN-CVE-2009-3894- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10001-1 No score
dstat-0.7.3-1.3 on GA media
These are all security issues fixed in the dstat-0.7.3-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10001-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14878-1 No score
dool-1.3.4-2.1 on GA media
These are all security issues fixed in the dool-1.3.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14878-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dstatDebian:12 |
before 0.7.0-1 | 0.7.0-1 |
dstatRed Hat:enterprise_linux:5::client |
before 0:0.6.6-3.el5_4.1 | 0:0.6.6-3.el5_4.1 |
dstatRed Hat:enterprise_linux:5::server |
before 0:0.6.6-3.el5_4.1 | 0:0.6.6-3.el5_4.1 |
dstatopenSUSE:Tumbleweed |
before 0.7.3-1.3 | 0.7.3-1.3 |
doolopenSUSE:Tumbleweed |
before 1.3.4-2.1 | 1.3.4-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3894 is a medium vulnerability (CVSS 4.4) in Dag.wieers Dstat, published November 27, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in dstat 0.7.0-1.
References
security.gentoo.org/glsa/glsa-200911-04.xml
osvdb.org/60511
mandriva.com/security/advisories?name=MDVSA-2009:341
bugs.gentoo.org/show_bug.cgi?id=293497
svn.rpmforge.net/svn/trunk/tools/dstat/ChangeLog
secunia.com/advisories/37445
Show 14 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=538459
redhat.com/support/errata/RHSA-2009-1619.html
securityfocus.com/bid/37131
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8969
nvd.nist.gov/vuln/detail/CVE-2009-3894
github.com/advisories/GHSA-c59x-5529-vcp7
security-tracker.debian.org/tracker/CVE-2009-3894
access.redhat.com/errata/RHSA-2009:1619
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1619.json
cve.org/CVERecord?id=CVE-2009-3894
suse.com/security/cve/CVE-2009-3894