CVE-2011-1930: Debian Linux

Critical severity, CVSS 9.8. EPSS: 20.5% chance of exploitation in the next 30 days.

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Klibc Project Klibc: before 1.5.25 (fixed in 1.5.25)

Published 2019-11-14. Last modified 2026-06-16.