CVE-2011-2709
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to...
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
Exploit likelihood
What each source reports
NVD Score used
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
- Record
CVE-2011-2709- CVSS 2.0
- 6.2 Medium
AV:L/AC:H/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
- Record
CVE-2011-2709- Updated
- 2026-11-02
EUVDEUVD-2011-2690 No score
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
- Record
EUVD-2011-2690- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9g5-vjrr-pw76 No score
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to...
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
- Record
GHSA-q9g5-vjrr-pw76- Updated
- 2026-11-02
OSV No score
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
- Record
CVE-2011-2709- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2709 No score
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
- Record
DEBIAN-CVE-2011-2709- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10085-1 No score
libgssglue-devel-0.4-5.10 on GA media
These are all security issues fixed in the libgssglue-devel-0.4-5.10 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10085-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgssglueDebian:12 |
before 0.4-1 | 0.4-1 |
libgssglueDebian:13 |
before 0.4-1 | 0.4-1 |
libgssglueDebian:14 |
before 0.4-1 | 0.4-1 |
libgssglueopenSUSE:Tumbleweed |
before 0.4-5.10 | 0.4-5.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2709 is a medium vulnerability (CVSS 6.2) in Umich Libgssapi, published June 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in libgssglue 0.4-1.
References
openwall.com/lists/oss-security/2011/07/21/3
bugzilla.novell.com/show_bug.cgi?id=694598
lists.fedoraproject.org/pipermail/package-announce/2012-June/082297.html
secunia.com/advisories/45075
securityfocus.com/bid/48490
citi.umich.edu/projects/nfsv4/linux/libgssglue/libgssglue-0.4.tar.gz
Show 10 moreShow less
lwn.net/Alerts/449415
nvd.nist.gov/vuln/detail/CVE-2011-2709
github.com/advisories/GHSA-q9g5-vjrr-pw76
security-tracker.debian.org/tracker/CVE-2011-2709
suse.com/security/cve/CVE-2011-2709