CVE-2009-3894: Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges v...

Security readout for executives and security teams

CVE-2009-3894 is a local privilege escalation issue in dstat before 0.7.0. A local user could abuse how dstat searches for Python modules and cause it to load a malicious module from a working directory. Business urgency is highest on shared Linux systems or systems where dstat may be run with elevated privileges. Exposure is likely limited to systems with dstat installed at versions before 0.7.0. Risk increases on multi-user systems and environments where administrators run dstat from directories writable by untrusted users. Treat as a targeted legacy Linux hygiene issue. Prioritize shared servers, administrative jump hosts, and systems with local shell users. It is less urgent than remote code execution, but still relevant where privilege boundaries matter. Mitigation focus: Upgrade dstat to 0.7.0 or a vendor-fixed package.; Apply relevant distribution advisories from Gentoo, Mandriva, or Red Hat where applicable.; Restrict untrusted local users from influencing administrator working directories..

Prepared

Jun 28, 2026, 14:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.