p PatchFirst

CVE-2011-1930

CVE-2011-1930

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.

CVSS 9.8 · Critical · EPSS 20.5% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • klibc

    Versions
    • 1.5.20: Affected
    • 1.5.21: Affected

    No fix published

  • klibc Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.5.22-1

    Update to 1.5.22-1

  • klibc Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.5.22-1

    Update to 1.5.22-1

  • klibc Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.5.22-1

    Update to 1.5.22-1

Original sources

Check your server →