CVE-2009-2084

Name	CVE-2009-2084
Description	Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1776-1
Debian Bugs	524980

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
slurm-llnl (PTS)	jessie, jessie (lts)	14.03.9-5+deb8u5	fixed
	stretch (security), stretch (lts), stretch	16.05.9-1+deb9u5	fixed
	buster (security), buster, buster (lts)	18.08.5.2-1+deb10u2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
slurm-llnl	source	lenny	1.3.6-1lenny3
slurm-llnl	source	(unstable)	1.3.15-1			524980