CVE-2011-3626 Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted st...
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drusus logsurfer | <= 1.5b | No fix listed |
| drusus logsurfer | = 1.1 | No fix listed |
| drusus logsurfer | = 1.2 | No fix listed |
| drusus logsurfer | = 1.3 | No fix listed |
| drusus logsurfer | = 1.4 | No fix listed |
| drusus logsurfer | = 1.5 | No fix listed |
| drusus logsurfer | = 1.5-beta | No fix listed |
| drusus logsurfer | = 1.5-beta2 | No fix listed |
| drusus logsurfer | = 1.5a | No fix listed |
| drusus logsurfer | = 1.41 | No fix listed |
| kerry thompson logsurfer+ | <= 1.7 | No fix listed |
| kerry thompson logsurfer+ | = 1.5a | No fix listed |
| kerry thompson logsurfer+ | = 1.5b | No fix listed |
| kerry thompson logsurfer+ | = 1.6 | No fix listed |
| kerry thompson logsurfer+ | = 1.6a | No fix listed |
| kerry thompson logsurfer+ | = 1.6b | No fix listed |
References
- 46389 third-party-advisory vendor-advisory
- 47725 third-party-advisory vendor-advisory
- GLSA-201201-04 vendor-advisory
- [oss-security] 20111017 CVE request: double-free vulnerability in logsurfer mailing-list patch
- [oss-security] 20111017 Re: CVE request: double-free vulnerability in logsurfer mailing-list
- bugs.gentoo.org patch vendor-advisory