CVE-2011-2709: Umich Libgssapi

Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days.

libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.

Affected products

• Umich Libgssapi: up to and including 0.3; version 0.1 only; version 0.2 only
• Umich Libgssglue: up to and including 0.3; version 0.1 only; version 0.2 only

Published 2012-06-21. Last modified 2026-06-16.