CVSS: 1.9EPSS: 0%CPEs: 14EXPL: 0CVE-2011-1155 – logrotate: DoS due improper escaping of file names within 'write state' action
https://notcve.org/view.php?id=CVE-2011-1155
The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. La función writeState en logrotate.c en Logrotate v3.7.9 y anteriores podría permitir a atacantes dependientes de contexto provocar una denegación de servicio ('rotation outage') a través de (1) \n (nueva línea) o (2) caracter \ (backslash) en ficheros de traza, como se demuestra en un archivo que es construido automáticamente en la base del nombre de host o nombre de máquina virtual. • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html http://openwall.com/lists/oss-security/2011/03/04/16 http://openwall.com/lists/oss-security/2011/03/04/17 http://openwall.com/lists/oss-security/2011/03/04/18 http://openwall.com/lists/oss-security/2011/03/04/19 http://openwall.com/lists/oss-security/2011/03/04/22 http://openwall.com/lists/oss-security/2 • CWE-399: Resource Management Errors •
CVSS: 6.9EPSS: 0%CPEs: 14EXPL: 0CVE-2011-1154 – logrotate: Shell command injection by using the shred configuration directive
https://notcve.org/view.php?id=CVE-2011-1154
The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. La función shred_file en logrotate.c en logrotate v3.7.9 y anteriores puede permitir a atacantes dependiendo del contexto, ejecutar comandos vía metacaracteres de la shell en un fichero de registro, como lo demuestra un nombre de archivo que es contruido de forma automática sobre la base de un nombre de host o máquina virtual. • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html http://openwall.com/lists/oss-security/2011/03/04/16 http://openwall.com/lists/oss-security/2011/03/04/17 http://openwall.com/lists/oss-security/2011/03/04/18 http://openwall.com/lists/oss-security/2011/03/04/19 http://openwall.com/lists/oss-security/2011/03/04/22 http://openwall.com/lists/oss-security/2 • CWE-20: Improper Input Validation •
CVSS: 1.9EPSS: 0%CPEs: 14EXPL: 0CVE-2011-1098 – logrotate: TOCTOU race condition by creation of new files (between opening the file and moment, final permissions have been applied) [information disclosure]
https://notcve.org/view.php?id=CVE-2011-1098
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place. Condición de carrera en la función createOutputFile en logrotate.c en logrotate v3.7.9 y anteriores permite a usuarios locales leer los datos de registro mediante la apertura de un archivo antes de que los permisos previstos este activos. • http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html http://openwall.com/lists/oss-security/2011/03/04/16 http://openwall.com/lists/oss-security/2011/03/04/17 http://openwall.com/lists/oss-security/2011/03/04/18 http://openwall.com/lists/oss-security/2011/03/04/19 http://openwall.com/lists/oss-security/2011/03/04/22 http://openwall.com/lists/oss-security/2 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •