Unscored CVE-2011-3180 EUVD-2011-3147GHSA-vq3j-4cjf-gfwg

kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attacke…

Published Apr 16, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

References

[oss-security] 20111102 kiwi shell meta char injection mailing-list
https://github.com/openSUSE/kiwi/commit/f0f74b3f6ac6d47f7919aa9db380c0ad41ffe55f#
SUSE-SU-2011:1324 vendor-advisory