CVE-2011-1496

🗓️ 18 Apr 2011 18:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 91 Views🌐 WEB

CVE-2011-1496 tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option

Reporter	Title	Published	Views	Family All 30
0day.today	tmux '-S' Option Incorrect SetGID Privilege Escalation Vulnerability	12 Apr 201100:00	–	zdt
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a local malicious individual to compromise the confidentiality, integrity, and accessibility of protected information	7 Jul 201600:00	–	bdu_fstec
Cvelist	CVE-2011-1496	18 Apr 201118:00	–	cvelist
Debian	[BSA-032] Security update for tmux	11 Apr 201116:49	–	debian
Debian	[SECURITY] [DSA 2212-1] tmux security update	7 Apr 201119:51	–	debian
Debian CVE	CVE-2011-1496	18 Apr 201118:00	–	debiancve
Tenable Nessus	Debian DSA-2212-1 : tmux - privilege escalation	8 Apr 201100:00	–	nessus
Tenable Nessus	Fedora 13 : tmux-1.4-3.fc13 (2011-5156)	19 Apr 201100:00	–	nessus
Tenable Nessus	Fedora 14 : tmux-1.4-3.fc14 (2011-5167)	18 Apr 201100:00	–	nessus
Tenable Nessus	Fedora 15 : tmux-1.4-4.fc15 (2011-5486)	20 Apr 201100:00	–	nessus

NVD

Node

nicholas_marriott tmuxMatch1.3

nicholas_marriott tmuxMatch1.4

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/66693
securityfocus	www.securityfocus.com/bid/47283
secunia	www.secunia.com/advisories/44081
lists	www.lists.fedoraproject.org/pipermail/package-announce/2011-April/058548.html
vupen	www.vupen.com/english/advisories/2011/0897
vupen	www.vupen.com/english/advisories/2011/1015
lists	www.lists.fedoraproject.org/pipermail/package-announce/2011-April/058452.html
lists	www.lists.fedoraproject.org/pipermail/package-announce/2011-April/058367.html
debian	www.debian.org/security/2011/dsa-2212
secunia	www.secunia.com/advisories/44239

Parameter	Position	Path	Description	CWE
/tmp/.whateveryouwant	path	/tmp/.whateveryouwant	tmux -S option.local privilege escalation via crafted socket path	CWE-264
/var/log/lastlog	path	/var/log/lastlog	shell command in -c that redirects to lastlog exploiting tmux -S	CWE-264
/var/log/wtmp	path	/var/log/wtmp	shell command in -c that redirects to wtmp exploiting tmux -S	CWE-264
/var/log/btmp	path	/var/log/btmp	shell command in -c that redirects to btmp exploiting tmux -S	CWE-264
/tmp/thcclear13/cleara	path	/tmp/thcclear13/cleara	shell command in -c invoking logcleaner software via crafted -S path	CWE-264

16 Jun 2026 23:29Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.6

EPSS0.00952

CWE-264