CVE-2011-2649 Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.
HighCVSS 7.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| marcus schafer kiwi | <= 3.74.1 | No fix listed |
| novell suse studio onsite | = 1.1 | No fix listed |
References
- SUSE-SU-2011:0917 vendor-advisory
- support.novell.com
- 49236 vdb-entry
- bugzilla.novell.com
- kiwi-fileutils-command-execution(69284) vdb-entry