CVE-2011-1095

Severity

62%

Complexity

19%

Confidentiality

165%

locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.

locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.

CVSS 2.0 Base Score 6.2. CVSS Attack Vector: local. CVSS Attack Complexity: high. CVSS Vector: (AV:L/AC:H/Au:N/C:C/I:C/A:C).

Overview

First reported 13 years ago

2011-04-10 02:55:00

Last updated 6 years ago

2018-10-09 19:30:00

Affected Software

GNU glibc 1.00

1.00

GNU glibc 1.01

1.01

GNU glibc 1.02

1.02

GNU glibc 1.03

1.03

GNU glibc 1.04

1.04

GNU glibc 1.05

1.05

GNU glibc 1.06

1.06

GNU glibc 1.07

1.07

GNU glibc 1.08

1.08

GNU glibc 1.09

1.09

GNU glibc 1.09.1

1.09.1

GNU glibc 2.0

2.0

GNU glibc 2.0.1

2.0.1

GNU glibc 2.0.2

2.0.2

GNU glibc 2.0.3

2.0.3

GNU glibc 2.0.4

2.0.4

GNU glibc 2.0.5

2.0.5

GNU glibc 2.0.6

2.0.6

GNU glibc 2.1

2.1

GNU glibc 2.1.1

2.1.1

GNU glibc 2.1.1.6

2.1.1.6

GNU glibc 2.1.2

2.1.2

GNU glibc 2.1.3

2.1.3

GNU glibc 2.1.3.10

2.1.3.10

GNU glibc 2.1.9

2.1.9

GNU glibc 2.2

2.2

GNU glibc 2.2.1

2.2.1

GNU glibc 2.2.2

2.2.2

GNU glibc 2.2.3

2.2.3

GNU glibc 2.2.4

2.2.4

GNU glibc 2.2.5

2.2.5

GNU glibc 2.3

2.3

GNU glibc 2.3.1

2.3.1

GNU glibc 2.3.2

2.3.2

GNU glibc 2.3.3

2.3.3

GNU glibc 2.3.4

2.3.4

GNU glibc 2.3.5

2.3.5

GNU glibc 2.3.6

2.3.6

GNU glibc 2.3.10

2.3.10

GNU glibc 2.4

2.4

GNU glibc 2.5

2.5

GNU glibc 2.5.1

2.5.1

GNU glibc 2.6

2.6

GNU glibc 2.6.1

2.6.1

GNU glibc 2.7

2.7

GNU glibc 2.8

2.8

GNU glibc 2.9

2.9

GNU glibc 2.10

2.10

GNU glibc 2.10.1

2.10.1

GNU glibc 2.10.2

2.10.2

GNU glibc 2.11

2.11

GNU glibc 2.11.1

2.11.1

GNU glibc 2.11.2

2.11.2

GNU glibc 2.11.3

2.11.3

GNU glibc 2.12.0

2.12.0

GNU glibc 2.12.1

2.12.1

GNU glibc

References

http://bugs.gentoo.org/show_bug.cgi?id=330923

[oss-security] 20110308 Re: glibc locale escaping issue

[oss-security] 20110308 Re: glibc locale escaping issue

[oss-security] 20110308 glibc locale escaping issue

43830

Vendor Advisory

43976

Vendor Advisory

43989

Vendor Advisory

46397

GLSA-201011-01

Vendor Advisory

1025286

http://sources.redhat.com/bugzilla/show_bug.cgi?id=11904

http://sourceware.org/bugzilla/show_bug.cgi?id=11904

http://sourceware.org/git/?p=glibc.git;a=patch;h=026373745eab50a683536d950cb7e17dc98c4259

MDVSA-2011:178

RHSA-2011:0412

RHSA-2011:0413

20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

http://www.vmware.com/security/advisories/VMSA-2011-0012.html

ADV-2011-0863

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=625893

oval:org.mitre.oval:def:12272

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.