CVE-2011-3364
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c...
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.
Exploit likelihood
What each source reports
NVD Score used
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.
- Record
CVE-2011-3364- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.
- Record
CVE-2011-3364- Updated
- 2026-11-02
EUVDEUVD-2011-3328 No score
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.
- Record
EUVD-2011-3328- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-89wj-8hfp-9mjq No score
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c...
Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkManager 0.9.1, 0.9.0, 0.8.1, and possibly other versions, when PolicyKit is configured to allow users to create new connections, allows local users to execute arbitrary commands via a newline character in the name for a new network connection, which is not properly handled when writing to the ifcfg file.
- Record
GHSA-89wj-8hfp-9mjq- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
NetworkManagerRed Hat:enterprise_linux:6::server |
before 1:0.8.1-9.el6_1.3 | 1:0.8.1-9.el6_1.3 |
NetworkManager-debuginfoRed Hat:enterprise_linux:6::server |
before 1:0.8.1-9.el6_1.3 | 1:0.8.1-9.el6_1.3 |
NetworkManager-glibRed Hat:enterprise_linux:6::server |
before 1:0.8.1-9.el6_1.3 | 1:0.8.1-9.el6_1.3 |
NetworkManager-gnomeRed Hat:enterprise_linux:6::server |
before 1:0.8.1-9.el6_1.3 | 1:0.8.1-9.el6_1.3 |
NetworkManager-develRed Hat:enterprise_linux:6::server |
before 1:0.8.1-9.el6_1.3 | 1:0.8.1-9.el6_1.3 |
NetworkManager-glib-develRed Hat:enterprise_linux:6::server |
before 1:0.8.1-9.el6_1.3 | 1:0.8.1-9.el6_1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3364 is a medium vulnerability (CVSS 6.9) in Gnome Ifcfg-rh Plug-in, published November 4, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in NetworkManager 1:0.8.1-9.el6_1.3.
References
xorl.wordpress.com/2011/10/09/cve-2011-3364-gnome-networkmanager-local-privilege-escalation
lists.fedoraproject.org/pipermail/package-announce/2011-September/066828.html
bugzilla.redhat.com/show_bug.cgi?id=737338
mandriva.com/security/advisories?name=MDVSA-2011:171
redhat.com/support/errata/RHSA-2011-1338.html
nvd.nist.gov/vuln/detail/CVE-2011-3364