CVE-2011-3631

Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it, leading to hardlink executable crash or potentially arbitrary code execution with user privileges.

Score

CVSS 3.1 8.8 High

Status

Modified - secalert@redhat.com

Published

2019-11-26

Last modified

2024-08-06

Weaknesses

CWE-190

Affected products

• Debian Linux (Debian)
• Hardlink (Hardlink)
• Hardlink (Hardlink Project)
• Enterprise Linux (Redhat)

References

• https://access.redhat.com/security/cve/cve-2011-3631
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3631
• https://security-tracker.debian.org/tracker/CVE-2011-3631