The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service…

published 2011-03-30 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1168

cvss: 1.9; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits: 0; none known

The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.

Patch / fix

distros 3 links 4

debian red hat opensuse

logrotate Debian 14, Debian 13, Debian 12 3.8.0-1

debian advisories DEBIAN-CVE-2011-1155

logrotate RHEL 6 3.7.8-12.el6_0.1

red hat advisories RHSA-2011:0407

logrotate openSUSE Tumbleweed 3.10.0-4.1

opensuse advisories openSUSE-SU-2024:10231-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1155 updated 2026-11-07 cvss 1.9

logrotate: DoS due improper escaping of file names within 'write state' action

Red Hat Enterprise Linux 4 logrotate Red Hat Enterprise Linux 5 logrotate
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux Desktop (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux HPC Node (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux Server (v. 6) logrotate 3.7.8-12.el6_0.1 Red Hat Enterprise Linux Workstation (v. 6) logrotate 3.7.8-12.el6_0.1
fixed: vendor fix RHSA-2011:0407

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	1.9	AV:L/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

CWE-399 Resource Management Errors

References

lists.fedoraproject.org /pipermail/package-announce/2011-March/056992.html
vendor-advisory, patch
openwall.com /lists/oss-security/2011/03/04/16
mailing-list, patch
bugzilla.redhat.com /show_bug.cgi?id=680797
patch
openwall.com /lists/oss-security/2011/03/14/26
mailing-list, patch
lists.fedoraproject.org /pipermail/package-announce/2011-April/057845.html
vendor-advisory
mandriva.com /security/advisories?name=MDVSA-2011:065
vendor-advisory
redhat.com /support/errata/RHSA-2011-0407.html
vendor-advisory
vupen.com /english/advisories/2011/0791
vdb-entry, vendor-advisory
openwall.com /lists/oss-security/2011/03/04/19
mailing-list
openwall.com /lists/oss-security/2011/03/04/25
mailing-list
openwall.com /lists/oss-security/2011/03/04/30
mailing-list
openwall.com /lists/oss-security/2011/03/04/26
mailing-list
openwall.com /lists/oss-security/2011/03/10/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/28
mailing-list
openwall.com /lists/oss-security/2011/03/08/5
mailing-list
secunia.com /advisories/43955
third-party-advisory
openwall.com /lists/oss-security/2011/03/07/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/31
mailing-list
vupen.com /english/advisories/2011/0961
vdb-entry
openwall.com /lists/oss-security/2011/03/04/17
mailing-list
openwall.com /lists/oss-security/2011/03/10/6
mailing-list
openwall.com /lists/oss-security/2011/03/06/3
mailing-list
openwall.com /lists/oss-security/2011/03/04/29
mailing-list
openwall.com /lists/oss-security/2011/03/07/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/6
mailing-list
openwall.com /lists/oss-security/2011/03/05/4
mailing-list
openwall.com /lists/oss-security/2011/03/07/11
mailing-list
openwall.com /lists/oss-security/2011/03/23/11
mailing-list
openwall.com /lists/oss-security/2011/03/06/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/18
mailing-list
openwall.com /lists/oss-security/2011/03/10/2
mailing-list
openwall.com /lists/oss-security/2011/03/11/3
mailing-list
openwall.com /lists/oss-security/2011/03/10/7
mailing-list
openwall.com /lists/oss-security/2011/03/05/8
mailing-list
openwall.com /lists/oss-security/2011/03/04/22
mailing-list
openwall.com /lists/oss-security/2011/03/11/5
mailing-list
openwall.com /lists/oss-security/2011/03/04/27
mailing-list
vupen.com /english/advisories/2011/0872
vdb-entry
openwall.com /lists/oss-security/2011/03/04/32
mailing-list
openwall.com /lists/oss-security/2011/03/04/24
mailing-list
openwall.com /lists/oss-security/2011/03/04/33
openwall.com /lists/oss-security/2011/03/06/4
openwall.com /lists/oss-security/2011/03/06/6

Sources

CVE List CVE-2011-1155
NVD CVE-2011-1155

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary