CVE-2011-1920: Ihji Pmake

Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.

Affected products

• Ihji Pmake: version 1.111 only
• Netbsd Netbsd: any version; up to and including 1.6.1; version 1.0 only; version 1.1 only; version 1.2 only; version 1.2.1 only; …

Published 2011-05-23. Last modified 2026-06-16.