CVE-2011-3360

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows...

9.3 HighPublic exploitFix available

CVE-2011-3360 is a high vulnerability (CVSS 9.3) in Wireshark, published September 20, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.5%, the 98th percentile. Fixed in wireshark 1.6.2-1.

What does this mean?

Severity: 9.3 HighCVSS 2.0, NVD
Exploit chance: 34.5%EPSS, 98th percentile
Exploitation: None known2 public exploits
Fixed in: 1.6.2-1wireshark +5 more

Description

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Exploit likelihood

34.5%Down 8.8 points since Feb 4, 2022

Affected products

wireshark

Affected packages

Affected packages
Package	Affected	Fixed
`wireshark` Debian:12	before 1.6.2-1	1.6.2-1
`wireshark` Debian:13	before 1.6.2-1	1.6.2-1
`wireshark` Debian:14	before 1.6.2-1	1.6.2-1
`wireshark` Debian:6.0	before 1.2.11-6+squeeze4, plus listed versions 1.2.11-61.2.11-6+squeeze11.2.11-6+squeeze2	1.2.11-6+squeeze4
`wireshark` Debian:5.0	before 1.0.2-3+lenny15, plus listed versions 1.0.2-3+lenny101.0.2-3+lenny111.0.2-3+lenny121.0.2-3+lenny131.0.2-3+lenny14 Show 7 moreShow less 1.0.2-3+lenny31.0.2-3+lenny41.0.2-3+lenny51.0.2-3+lenny61.0.2-3+lenny71.0.2-3+lenny81.0.2-3+lenny9	1.0.2-3+lenny15
`wireshark` openSUSE:Tumbleweed From an advisory covering 262 CVEs	before 2.2.2-1.1	2.2.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Wireshark console.lua Pre-Loading Script Execution	2011-07-18
Exploit-DB	Wireshark - console.lua pre-loading (Metasploit)	2011-11-19

What each source reports

NVD Score used9.3

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Record: CVE-2011-3360
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE ListNo score

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Record: CVE-2011-3360
Updated: 2026-11-02

EUVDEUVD-2011-3324No score

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Record: EUVD-2011-3324
Updated: 2026-11-03

GitHub AdvisoriesGHSA-6c9g-wrqp-q548No score

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows...

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Record: GHSA-6c9g-wrqp-q548
Updated: 2026-11-02

OSVNo score

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Record: CVE-2011-3360
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-3360No score

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.

Record: DEBIAN-CVE-2011-3360
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10199-1No score

wireshark-2.2.2-1.1 on GA media

These are all security issues fixed in the wireshark-2.2.2-1.1 package on the GA media of openSUSE Tumbleweed.