CVE-2011-3180

kiwi < 4.98.08 - OS Command Injection via Overlay File Path

Title source: llm
STIX 2.1

Description

kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

References (3)

Core 3
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/11/02/4
Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00015.html

Scores

EPSS 0.0149
EPSS Percentile 81.3%

Details

Status published
Products (3)
suse/kiwi < 4.98.07
suse/studio_extension_for_system_z 1.2
suse/studio_onsite 1.2
Published Apr 16, 2014
Tracked Since Feb 18, 2026