CVE-2011-0995 sqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges
Local attackers can exploit weak file permissions in the sqlite3-ruby gem to escalate privileges on SUSE Linux Enterprise systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-0995?
CVE-2011-0995 is a low-severity vulnerability in n/a, published on 13 May 2011. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
Weakness: CWE-264
Which versions are affected by CVE-2011-0995?
2 open source packages ship an affected version, including sqlite3-ruby. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sqlite3-ruby RubyGems | All versions | 1.2.4 |
sqlite3-ruby RubyGems | All versions | 1.2.4 |
Products include Novell Suse Linux Enterprise, Rubyforge Rubygem-Sqlite3.
How do I fix CVE-2011-0995?
Upgrade sqlite3-ruby to 1.2.4 or later.
Is CVE-2011-0995 being exploited?
There is no known exploitation of CVE-2011-0995 in the wild and no public exploit code.
Sources
Also known as GHSA-6x46-7rrv-m4h8.