CVE-2011-2923

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
foomatic-filters	foomatic-filters	all versions

References

https://access.redhat.com/security/cve/cve-2011-2923Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2923Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-2923Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2923Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-2923Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2923Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-2923Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2923Third Party Advisory

Timeline

Published: Nov 19, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29245.5foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the CVE-2011-29254.6Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows lo CVE-2011-29275.4A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attacker CVE-2011-29284.9The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlin CVE-2011-29295.0The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x befor CVE-2011-29307.5Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connect CVE-2011-29314.3Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ru CVE-2011-29324.3Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.CVE-2011-29337.2An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploa CVE-2011-29348.8A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate CVE-2011-29356.1Elgg through 1.7.10 has XSS CVE-2011-29369.8Elgg through 1.7.10 has a SQL injection vulnerability