CVE-2011-3172

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-304CWE-264

Affected software

VendorProductVersions
SUSESUSE Linux Enterprise>= unspecified, < 12

References

Timeline

Published
Jun 8, 2018
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-31737.5Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OECVE-2011-31746.8Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZECVE-2011-317510.0Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers CVE-2011-317610.0Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers CVE-2011-31777.8The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of netwoCVE-2011-31788.8In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attacCVE-2011-31795.0The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers CVE-2011-31807.5kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackerCVE-2011-31814.3Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allowCVE-2011-31825.0PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependCVE-2011-31836.1A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.CVE-2011-31844.3The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle