CVE catalog

CVE-2011-3616

conky: CVE-2011-3616

Severity: Medium
Published: Nov 4, 2011, 9:55:07 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.42% · Oct 25, 2026

The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	conky	sid	`1.24.2+dfsg-1`	fixed
Debian	conky	forky	`1.24.2+dfsg-1`	fixed
Debian	conky	trixie	`1.22.1-1`	fixed
Debian	conky	bookworm	`1.18.3-1`	fixed
Opensuse	conky	tumbleweed	`1.10.4-1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	conky	source	sid	`1.8.0-1.1`	low	Not reported	[612033]
Debian	conky	source	forky	`1.8.0-1.1`	low	Not reported	[612033]
Debian	conky	source	trixie	`1.8.0-1.1`	low	Not reported	[612033]
Debian	conky	source	bookworm	`1.8.0-1.1`	low	Not reported	[612033]
Opensuse	conky	rpm	tumbleweed	`1.10.4-1.2`	Not reported	OPENSUSE-SU-2024:10093-1	Not reported

[Debian bug #612033]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[conky-doc]Unknown
Source package: [conky]
Details (1)
- 1.24.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.10.4-1.2
  Version impact unknown
  dsa · conky · opensuse · tumbleweed
[nano-plugin-conky]Unknown
Source package: [conky]
Details (1)
- 1.24.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.10.4-1.2
  Version impact unknown
  dsa · conky · opensuse · tumbleweed
[vim-plugin-conky]Unknown
Source package: [conky]
Details (1)
- 1.24.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.10.4-1.2
  Version impact unknown
  dsa · conky · opensuse · tumbleweed
[conky]Fixed
Source package: [conky]
Details (1)
- 1.24.2-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.10.4-1.2
  dsa · conky · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[conky]Fixed
Details (2)
- 1.18.3-1 · all · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
- 1.18.3-1 · all · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
[conky-all]Fixed
Source package: [conky]
Details (2)
- 1.18.3-1 · amd64 · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
- 1.18.3-1 · arm64 · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
[conky-cli]Fixed
Source package: [conky]
Details (2)
- 1.18.3-1 · amd64 · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
- 1.18.3-1 · arm64 · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
[conky-std]Fixed
Source package: [conky]
Details (2)
- 1.18.3-1 · amd64 · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12
- 1.18.3-1 · arm64 · bookworm
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · bookworm; dsa · conky · debian · 12

[Debian 13 (Trixie)]

[conky-all]Fixed
Source package: [conky]
Details (2)
- 1.22.1-1 · amd64 · trixie
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · 13
- 1.22.1-1 · arm64 · trixie
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · 13
[conky-cli]Fixed
Source package: [conky]
Details (2)
- 1.22.1-1 · amd64 · trixie
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · 13
- 1.22.1-1 · arm64 · trixie
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · 13
[conky-std]Fixed
Source package: [conky]
Details (2)
- 1.22.1-1 · amd64 · trixie
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · 13
- 1.22.1-1 · arm64 · trixie
  Fixed · Fixed: 1.8.0-1.1
  dsa · conky · debian · 13

Observed: Oct 23, 2026, 5:05:36 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]