CVE-2011-3626: Drusus Logsurfer

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file.

Affected products

• Drusus Logsurfer: up to and including 1.5b; version 1.1 only; version 1.2 only; version 1.3 only; version 1.4 only; version 1.5 only; …
• Kerry Thompson Logsurfer+: up to and including 1.7; version 1.5a only; version 1.5b only; version 1.6 only; version 1.6a only; version 1.6b only

Published 2012-01-27. Last modified 2026-06-16.