{"id":"CVE-2011-2520","aliases":["EUVD-2011-2505","GHSA-j359-qhq6-r897","RHSA-2011:0953"],"status":"published","title":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely...","description":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00421,"percentile":0.36695,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2011-07-21T23:00:00Z","modified":"2026-06-16T23:31:30Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-firewall","fixed_in":["0:1.2.27-3.el6_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-firewall-base","fixed_in":["0:1.2.27-3.el6_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-firewall-tui","fixed_in":["0:1.2.27-3.el6_1.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer","fixed_in":["0:1.1.16-17.el6_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer-debuginfo","fixed_in":["0:1.1.16-17.el6_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer-libs","fixed_in":["0:1.1.16-17.el6_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer-udev","fixed_in":["0:1.1.16-17.el6_1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-firewall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.27-3.el6_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-firewall-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.27-3.el6_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-firewall-tui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.27-3.el6_1.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.16-17.el6_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.16-17.el6_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.16-17.el6_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"system-config-printer-udev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.16-17.el6_1.2"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"redhat","product":"system-config-firewall"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063314.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/68734","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2011/07/18/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=717985","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0953.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Not Applicable"]},{"url":"http://www.securityfocus.com/bid/48715","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link"]},{"url":"http://securitytracker.com/id?1025793","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/45294","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2520","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0953","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2520","tags":["report"]},{"url":"https://github.com/advisories/GHSA-j359-qhq6-r897"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0953.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2520","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-2520","description":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.","status":"published","published":"2011-07-21T23:00:00Z","modified":"2024-08-06T23:00:34.079Z","updated_at":"2026-11-02T14:35:36.603688Z"}],"euvd":[{"id":"EUVD-2011-2505","description":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.","status":"published","published":"2011-07-21T23:00:00Z","modified":"2024-08-06T23:00:34Z","updated_at":"2026-11-03T01:39:55.11051Z"}],"ghsa":[{"id":"GHSA-j359-qhq6-r897","title":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely...","description":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.","status":"published","published":"2022-05-17T01:54:55Z","modified":"2024-01-21T03:30:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:55:27.854531Z"}],"nvd":[{"id":"CVE-2011-2520","description":"fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.","status":"published","published":"2011-07-21T23:55:03.41Z","modified":"2026-06-16T23:31:30.333Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:L/AC:H/Au:S/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:02:09.182398Z"}],"osv":[{"id":"RHSA-2011:0953","title":"Red Hat Security Advisory: system-config-firewall security update","status":"published","published":"2024-09-15T19:16:39Z","modified":"2026-03-13T21:26:50.431893Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}