CVE-2011-3870

MediumCVSS 6.3/10Last modified Jun 16, 2026

Description

Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.

Metrics

CVSS 2.0 6.3/10AV:L/AC:M/Au:N/C:N/I:C/A:C

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Oct 27, 2011
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-38716.2Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local usCVE-2011-38722.6Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent ceCVE-2011-38736.8Google Chrome before 14.0.835.202 does not properly implement shader translation, which allows remote attackers to execute arbitrary code orCVE-2011-38749.3Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to eCVE-2011-38754.3Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackCVE-2011-38766.8Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, whichCVE-2011-38774.3Cross-site scripting (XSS) vulnerability in the appcache internals page in Google Chrome before 15.0.874.102 allows remote attackers to injeCVE-2011-38786.8Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other CVE-2011-38797.5Google Chrome before 15.0.874.102 does not prevent redirects to chrome: URLs, which has unspecified impact and remote attack vectors.CVE-2011-38807.5Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknownCVE-2011-38814.3WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and coCVE-2011-38827.5Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unsp
CVE-2011-3870: Medium severity, CVSS 6.3 | Vulnix