CVE-2019-12575

https://notcve.org/view.php?id=CVE-2019-12575

A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The root_runner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts to load several libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can create a malicious library under this path to execute arbitrary code as the root user. Una vulnerabilidad en el cliente VPN de Private Internet Access (PIA) de London Trust Media para Linux, podría permitir a un atacante local autenticado ejecutar código arbitrario con privilegios elevados. • https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12575.txt • CWE-427: Uncontrolled Search Path Element •