CVE-2011-3180

kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 80%
VendorProductVersion
susekiwi
𝑥
≤ 4.98.07
susestudio_extension_for_system_z
1.2
susestudio_onsite
1.2
𝑥
= Vulnerable software versions
References
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html
http://www.openwall.com/lists/oss-security/2011/11/02/4
https://github.com/openSUSE/kiwi/commit/f0f74b3f6ac6d47f7919aa9db380c0ad41ffe55f#
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html
http://www.openwall.com/lists/oss-security/2011/11/02/4
https://github.com/openSUSE/kiwi/commit/f0f74b3f6ac6d47f7919aa9db380c0ad41ffe55f#