Posted by Ron E on Sep 03 Description:

Arbitrary code execution is possible in the MQTTVersion utility due to

uncontrolled loading of shared libraries using non-absolute paths. The

application invokes dlopen() with relative library names and relies on the

dynamic loader’s search path to resolve the target library. Because the

library origin is not restricted to trusted directories and no integrity or

authenticity checks are performed, an attacker can cause a malicious...