CVE-2011-2649

Kiwi < 3.74.2 - OS Command Injection via FileUtils Function

Title source: llm

Description

Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.

References (5)

Core 5

Core References

Vendor Advisory x_refsource_confirm

http://support.novell.com/security/cve/CVE-2011-2649.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/49236

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00013.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/69284

Issue Tracking x_refsource_confirm

https://bugzilla.novell.com/show_bug.cgi?id=701815

Scores

EPSS 0.0037

EPSS Percentile 59.2%

Details

CWE

CWE-20

Status published

Products (2)

marcus_schafer/kiwi < 3.74.1

novell/suse_studio_onsite 1.1

Published Aug 23, 2011

Tracked Since Feb 18, 2026