CVE-2011-3630

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
hardlink	hardlink	before 0.1.2

References

https://access.redhat.com/security/cve/cve-2011-3630Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630Issue Tracking, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3630Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/10/20/6Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-3630Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630Issue Tracking, Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3630Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/10/20/6Mailing List, Third Party Advisory

Timeline

Published: Nov 26, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-36318.8Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation CVE-2011-36327.1Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink a CVE-2011-36342.6methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which CVE-2011-36354.3Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempath CVE-2011-36366.8Cross-site request forgery (CSRF) vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the au CVE-2011-36375.5The m_stop function in fs/proc/task_mmu.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (OOPS) via vecto CVE-2011-36384.0fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases of extent splitting, which allows CVE-2011-36394.3The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, do CVE-2011-36407.1Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, CVE-2011-36429.6Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and CVE-2011-36457.5Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.j CVE-2011-36465.0phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame para