Improper input validation in Gentoo Logrotate

CVE-2011-1154

The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically con…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.001 (16.4th percentile) — read the EPSS interpretation.

Affected products

Gentoo Logrotate — versions 3.3, 3.5.9, 3.6.5
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

[oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110304 CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110310 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110304 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
[oss-security] 20110308 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)
43955 (x_refsource_SECUNIA, third-party-advisory)
[oss-security] 20110307 Re: CVE Request -- logrotate -- nine issues (mailing-list, x_refsource_MLIST)