CVE-2011-2910

MediumCVSS 6.7/10Last modified Jun 16, 2026

Description

The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
ax25-tools	ax25-tools	before 0.0.8-13

References

https://access.redhat.com/security/cve/cve-2011-2910Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2910Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2910Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-2910Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2910Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2910Third Party Advisory

Timeline

Published: Nov 15, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29116.8Integer overflow in the CSoundFile::ReadWav function in src/load_wav.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a den CVE-2011-29126.8Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before 0.8.8.4 allows remote attackers to CVE-2011-29136.8Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a den CVE-2011-29146.8Off-by-one error in the CSoundFile::ReadDSM function in src/load_dms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a den CVE-2011-29156.8Off-by-one error in the CSoundFile::ReadAMS2 function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a de CVE-2011-29165.5qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home director CVE-2011-29177.5SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL comm CVE-2011-29185.5The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_C CVE-2011-29194.3Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arb CVE-2011-29205.5A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to injec CVE-2011-29219.8ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can res CVE-2011-29227.8ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and us