CVE-2011-4195
HighSummary
A vulnerability in kiwi before version 4.98.05, used in SUSE Studio Onsite 1.2 before version 1.2.1 and SUSE Studio Extension for System z 1.2 before version 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
Risk Assessment
Attackers can exploit this vulnerability to gain control over the system, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update kiwi to version 4.98.05 or later and to update SUSE Studio Onsite and SUSE Studio Extension to version 1.2.1 or later.
Other vulnerabilities in kiwi, SUSE Studio Onsite, SUSE Studio Extension for System z
See all- CVE-2011-4192High
Kiwi before version 4.85.1, used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by 'double quotes in kiwi_oemtitle of .profile.'
- CVE-2011-3180High
A vulnerability in kiwi before version 4.98.08, used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
Original NVD description (English source)
kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.