CVE-2008-2378
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain...
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.
Exploit likelihood
What each source reports
NVD Score used
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.
- Record
CVE-2008-2378- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.
- Record
CVE-2008-2378- Updated
- 2026-11-02
EUVDEUVD-2008-2373 No score
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.
- Record
EUVD-2008-2373- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m54c-9qcv-gm87 No score
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain...
Untrusted search path vulnerability in hfkernel in hf 0.7.3 and 0.8 allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH, related to improper handling of the -k option.
- Record
GHSA-m54c-9qcv-gm87- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hfDebian:4.0 |
before 0.7.3-4etch1, plus listed versions 0.7.3-4 |
0.7.3-4etch1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2378 is a high vulnerability (CVSS 7.2) in Hf, published November 22, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in hf 0.7.3-4etch1.
References
exchange.xforce.ibmcloud.com/vulnerabilities/46806
secunia.com/advisories/32855
osvdb.org/50231
bugs.debian.org/cgi-bin/bugreport.cgi?bug=504182
debian.org/security/2008/dsa-1668
securityfocus.com/bid/32421
nvd.nist.gov/vuln/detail/CVE-2008-2378
github.com/advisories/GHSA-m54c-9qcv-gm87