Debian Security Advisory 1045-1: Hendrik Weimer discovered that OpenVPN, the Virtual Private Network daemon, allows to push environment variables to a client allowing a malicious VPN server to take over connected clients.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45897/dsa-1045-1.txt
Source: https://packetstormsecurity.com/files/45897/Debian-Linux-Security-Advisory-1045-1.html