CVE catalog

CVE-2009-3894

dstat: CVE-2009-3894

Severity: Medium
Published: Nov 29, 2009, 1:07:52 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 25, 2026

Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	dstat	bookworm	`0.7.4-6.1`	fixed
Opensuse	dool	tumbleweed	`1.3.4-2.1`	fixed
Opensuse	dstat	tumbleweed	`0.7.3-1.3`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	dstat	source	bookworm	`0.7.0-1`	low	Not reported	[557989]
Opensuse	dool	rpm	tumbleweed	`1.3.4-2.1`	Not reported	OPENSUSE-SU-2025:14878-1	Not reported
Opensuse	dstat	rpm	tumbleweed	`0.7.3-1.3`	Not reported	OPENSUSE-SU-2024:10001-1	Not reported

[Debian bug #557989]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[dstat]Fixed
Details (2)
- 0.7.4-6.1 · all · bookworm
  Fixed · Fixed: 0.7.0-1
  dsa · dstat · debian · bookworm; dsa · dstat · debian · 12
- 0.7.4-6.1 · all · bookworm
  Fixed · Fixed: 0.7.0-1
  dsa · dstat · debian · bookworm; dsa · dstat · debian · 12

[openSUSE Tumbleweed]

[dool]Fixed
Source package: [dool]
Details (1)
- 1.3.8-1.3 · noarch · tumbleweed
  Fixed · Fixed: 1.3.4-2.1
  dsa · dool · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:04:43 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]