CVE-2011-3177

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration files, like passwords for wireless networks.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.suse.com/show_bug.cgi?id=713661Issue Tracking, Third Party Advisory
https://github.com/yast/yast-core/commit/7fe2e3df308b8b6a901cb2cfd60f398df53219deThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=713661Issue Tracking, Third Party Advisory
https://github.com/yast/yast-core/commit/7fe2e3df308b8b6a901cb2cfd60f398df53219deThird Party Advisory

Timeline

Published: Sep 8, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-31788.8In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attac CVE-2011-31795.0The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers CVE-2011-31807.5kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attacker CVE-2011-31814.3Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow CVE-2011-31825.0PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-depend CVE-2011-31836.1A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.CVE-2011-31844.3The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle CVE-2011-31859.3gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a messa CVE-2011-31864.3CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to CVE-2011-31874.3The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For heade CVE-2011-31889.1The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragm CVE-2011-31894.3The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which