CVE-2011-1098
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier...
CVE-2011-1098 is a low vulnerability (CVSS 1.9) in Gentoo Logrotate, published March 30, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in logrotate 3.8.0-1.
- Severity
- 1.9 LowCVSS 2.0, NVD
- Exploit chance
- 0.28%EPSS, 20th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.8.0-1logrotate +11 more
Description
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
logrotateDebian:12 | before 3.8.0-1 | 3.8.0-1 |
logrotateDebian:13 | before 3.8.0-1 | 3.8.0-1 |
logrotateDebian:14 | before 3.8.0-1 | 3.8.0-1 |
logrotateRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotate-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotateRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotate-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotateRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotate-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotateRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotate-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs | before 0:3.7.8-12.el6_0.1 | 0:3.7.8-12.el6_0.1 |
logrotateopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 3.10.0-4.1 | 3.10.0-4.1 |
What each source reports
NVD Score used
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
- Record
CVE-2011-1098- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE ListNo score
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
- Record
CVE-2011-1098- Updated
- 2026-11-02
EUVDEUVD-2011-1112No score
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
- Record
EUVD-2011-1112- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h8gr-59qr-mxm6No score
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier...
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
- Record
GHSA-h8gr-59qr-mxm6- Weakness
- CWE-362
- Updated
- 2026-11-02
OSVNo score
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
- Record
CVE-2011-1098- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1098No score
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
- Record
DEBIAN-CVE-2011-1098- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10231-1No score
logrotate-3.10.0-4.1 on GA media
These are all security issues fixed in the logrotate-3.10.0-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10231-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2011/03/04/19
Show 56 moreShow less
secunia.com/advisories/43955
vupen.com/english/advisories/2011/0961
lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html
mandriva.com/security/advisories?name=MDVSA-2011:065
bugzilla.redhat.com/show_bug.cgi?id=680798
redhat.com/support/errata/RHSA-2011-0407.html
nvd.nist.gov/vuln/detail/CVE-2011-1098
access.redhat.com/errata/RHSA-2011:0407
github.com/advisories/GHSA-h8gr-59qr-mxm6
security-tracker.debian.org/tracker/CVE-2011-1098
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0407.json
cve.org/CVERecord?id=CVE-2011-1098
suse.com/security/cve/CVE-2011-1098