Vulnerability Description
Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hardlink Project | Hardlink | < 0.1.2 |
| Debian | Debian Linux | 8.0 |
| Redhat | Enterprise Linux | 5.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/cve-2011-3630Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630Issue TrackingPatchThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2011-3630Third Party Advisory
- https://www.openwall.com/lists/oss-security/2011/10/20/6Mailing ListThird Party Advisory
- https://access.redhat.com/security/cve/cve-2011-3630Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630Issue TrackingPatchThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2011-3630Third Party Advisory
- https://www.openwall.com/lists/oss-security/2011/10/20/6Mailing ListThird Party Advisory
FAQ
What is CVE-2011-3630?
CVE-2011-3630 is a vulnerability with a CVSS score of 8.8 (HIGH). Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a speciall...
How severe is CVE-2011-3630?
CVE-2011-3630 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-3630?
Check the references section above for vendor advisories and patch information. Affected products include: Hardlink Project Hardlink, Debian Debian Linux, Redhat Enterprise Linux.