Untrusted Search Path Vulnerability in Google Picasa

CVE-2011-0458

Summary

The vulnerability in Google Picasa arises from an untrusted search path in the Locate on Disk feature. When operating within this application, local users can elevate their privileges by executing a Trojan horse executable that exists in the current working directory. This flaw enables potential attackers to manipulate executable files to gain unauthorized access to system-level privileges.

References