CVE-2011-4328
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie...
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
Exploit likelihood
What each source reports
NVD Score used
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
- Record
CVE-2011-4328- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
- Record
CVE-2011-4328- Updated
- 2026-11-02
EUVDEUVD-2011-4260 No score
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
- Record
EUVD-2011-4260- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-43gq-7wp4-9vh5 No score
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie...
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
- Record
GHSA-43gq-7wp4-9vh5- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnashDebian:6.0 |
before 0.8.8-5+squeeze1, plus listed versions 0.8.8-50.8.8-5squeeze10.8.8-5squeeze2 |
0.8.8-5+squeeze1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4328 is a medium vulnerability (CVSS 5.0) in Gnu Gnash, published March 19, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.11%, the 81st percentile. Fixed in gnash 0.8.8-5+squeeze1.
References
openwall.com/lists/oss-security/2011/11/21/12
lists.opensuse.org/opensuse-updates/2012-03/msg00003.html
git.savannah.gnu.org/gitweb?p=gnash.git%3Ba=commitdiff%3Bh=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55
secunia.com/advisories/48325
securityfocus.com/bid/50747
Show 9 moreShow less
bugs.debian.org/cgi-bin/bugreport.cgi?bug=649384
debian.org/security/2012/dsa-2435
osvdb.org/77243
bugzilla.redhat.com/show_bug.cgi?id=755518
nvd.nist.gov/vuln/detail/CVE-2011-4328
github.com/advisories/GHSA-43gq-7wp4-9vh5