Potential arbitrary code execution via dlopen

[szsam]

The value of the first argument of dlopen() may come from getenv. Using externally controlled strings in a process operation can allow an attacker to execute malicious commands.

alsa-lib/src/dlmisc.c

Line 155 in ed6b070

handle = dlopen(filename, mode);

alsa-lib/src/pcm/pcm_ladspa.c

Line 1094 in ed6b070

handle = dlopen(filename, RTLD_LAZY);

[perexg]

This is nothing we can do about it. If you don't like this behaviour, remove the code or mangle getenv function calls. Actually, every dynamic linked application may use LD_PRELOAD dynamic variable, so the security is not a question for this.