Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 02 Nov 2011 10:03:07 +0000
From: Thomas Biege <>
Subject: kiwi shell meta char injection

my colleagues found the following:

CVE-2011-3180: The path of overlay files was not escaped which allowed
shell meta character injection via the chown(1) command-line.
CVE-2011-4195: The image name was not escaped properly and can be used
in conjunction with other applications to execute arbitrary shell

Thomas Biege <>, Project Manager IT-Security
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend├Ârffer, HRB
21284 (AG N├╝rnberg)
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ