CVE catalog

CVE-2011-1020

linux-2.6 - several issues

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.92% · Oct 25, 2026

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls. kernel: no access restrictions of /proc/pid/* after setuid program exec Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via RHSA-2012:0007, RHSA-2011:1530 and RHSA-2011:1253 respectively. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlinux-2.66.02.6.32-30vulnerable
Debianlinux-2.66.02.6.32-30+m68k.5vulnerable
Debianlinux-2.66.02.6.32-31vulnerable
Debianlinux-2.66.02.6.32-31~bpo50+1vulnerable
Debianlinux-2.66.02.6.32-32vulnerable
Debianlinux-2.66.02.6.32-33vulnerable
Debianlinux-2.66.02.6.32-34vulnerable
Debianlinux-2.66.02.6.32-34squeeze1vulnerable
Debianlinux-2.66.02.6.32-35vulnerable
Debianlinux-2.66.02.6.32-35~bpo50+1vulnerable
Debianlinux-2.66.02.6.32-35squeeze1fixed
Debianlinux-2.65.02.6.26-13vulnerable
Debianlinux-2.65.02.6.26-13lenny2vulnerable
Debianlinux-2.65.02.6.26-13lenny2~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-14vulnerable
Debianlinux-2.65.02.6.26-15vulnerable
Debianlinux-2.65.02.6.26-15lenny1vulnerable
Debianlinux-2.65.02.6.26-15lenny2vulnerable
Debianlinux-2.65.02.6.26-15lenny3vulnerable
Debianlinux-2.65.02.6.26-15~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-15~bpo40+2vulnerable
Debianlinux-2.65.02.6.26-16vulnerable
Debianlinux-2.65.02.6.26-17vulnerable
Debianlinux-2.65.02.6.26-17lenny1vulnerable
Debianlinux-2.65.02.6.26-17lenny2vulnerable
Debianlinux-2.65.02.6.26-17lenny2~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-17~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-18vulnerable
Debianlinux-2.65.02.6.26-19vulnerable
Debianlinux-2.65.02.6.26-19lenny1vulnerable
Debianlinux-2.65.02.6.26-19lenny2vulnerable
Debianlinux-2.65.02.6.26-19~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-20vulnerable
Debianlinux-2.65.02.6.26-20~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-21vulnerable
Debianlinux-2.65.02.6.26-21lenny1vulnerable
Debianlinux-2.65.02.6.26-21lenny2vulnerable
Debianlinux-2.65.02.6.26-21lenny3vulnerable
Debianlinux-2.65.02.6.26-21lenny4vulnerable
Debianlinux-2.65.02.6.26-21~bpo40+1vulnerable
Debianlinux-2.65.02.6.26-22vulnerable
Debianlinux-2.65.02.6.26-22lenny1vulnerable
Debianlinux-2.65.02.6.26-23vulnerable
Debianlinux-2.65.02.6.26-24vulnerable
Debianlinux-2.65.02.6.26-24lenny1vulnerable
Debianlinux-2.65.02.6.26-25vulnerable
Debianlinux-2.65.02.6.26-25lenny1vulnerable
Debianlinux-2.65.02.6.26-26vulnerable
Debianlinux-2.65.02.6.26-26lenny1vulnerable
Debianlinux-2.65.02.6.26-26lenny2vulnerable
Debianlinux-2.65.02.6.26-26lenny3vulnerable
Debianlinux-2.65.02.6.26-26lenny4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlinux-2.6deb6.02.6.32-35squeeze1Not reportedDSA-2303-1Not reported
Debianlinux-2.6deb5.02.6.26-26lenny4Not reportedDSA-2310-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]