CVE-2011-2928

MediumCVSS 4.9/10Last modified Jun 16, 2026

Description

The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinks, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) by accessing a long symlink on a malformed Be filesystem.

Metrics

CVSS 2.0 4.9/10AV:L/AC:L/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2011
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-29295.0The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x beforCVE-2011-29307.5Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connectCVE-2011-29314.3Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in RuCVE-2011-29324.3Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.CVE-2011-29337.2An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaCVE-2011-29348.8A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate CVE-2011-29356.1Elgg through 1.7.10 has XSSCVE-2011-29369.8Elgg through 1.7.10 has a SQL injection vulnerabilityCVE-2011-29374.3Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to injecCVE-2011-29384.3Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary weCVE-2011-29395.1Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might alloCVE-2011-29409.3stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspe
CVE-2011-2928: Medium severity, CVSS 4.9 | Vulnix