CVE-2010-4001
** DISPUTED ** GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the...
GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script
Exploit likelihood
What each source reports
NVD Score used
GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script
- Record
CVE-2010-4001- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script
- Record
CVE-2010-4001- Updated
- 2026-11-02
EUVDEUVD-2010-3977 No score
GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script
- Record
EUVD-2010-3977- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wv39-gr2w-7565 No score
** DISPUTED ** GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the...
** DISPUTED ** GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: CVE disputes this issue because the GMXLDLIB value is always added to the beginning of LD_LIBRARY_PATH at a later point in the script.
- Record
GHSA-wv39-gr2w-7565- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10577-1 No score
gromacs-2016.1-1.1 on GA media
These are all security issues fixed in the gromacs-2016.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10577-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gromacsopenSUSE:Tumbleweed |
before 2016.1-1.1 | 2016.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4001 is a medium vulnerability (CVSS 4.6) in Gromacs, published November 5, 2010. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in gromacs 2016.1-1.1.
References
vupen.com/english/advisories/2010/2971
lists.fedoraproject.org/pipermail/package-announce/2010-November/050783.html
bugzilla.redhat.com/show_bug.cgi?id=644596
nvd.nist.gov/vuln/detail/CVE-2010-4001
github.com/advisories/GHSA-wv39-gr2w-7565
suse.com/security/cve/CVE-2010-4001