CVE catalog

CVE-2011-3178

open-build-service: CVE-2011-3178

[CVE catalog]

Severity
Low
Source
[NVD] · [CVE record]
EPSS
1.30% · Oct 25, 2026

In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopen-build-servicesid2.9.4-13not affected
Debianopen-build-servicebookworm2.9.4-9not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopen-build-servicesourcesidNot affectedunimportantNot reportedNot reported
Debianopen-build-servicesourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [obs-productconverter]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

  • [obs-server]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

  • [obs-utils]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

  • [obs-worker]Not affected

    Source package: [open-build-service]

    Details (2)

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

    • 2.9.4-9 · all · bookworm

      Not affected

      dsa · open-build-service · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS]