VIR Vulnerability Intelligence Relay

CVE-2011-0465

critical
Published 2011-04-08 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
9.3

Description

xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 7.6+2
sid Fixed 7.6+2
forky Fixed 7.6+2
bullseye Fixed 7.6+2
bookworm Fixed 7.6+2

Application impact
VendorProductVersionsFixed
matthias_hopfxrdb{"endIncluding":"1.0.8"}
matthias_hopfxrdb1.0.2
matthias_hopfxrdb1.0.3
matthias_hopfxrdb1.0.4
matthias_hopfxrdb1.0.5
matthias_hopfxrdb1.0.6
matthias_hopfxrdb1.0.7
xx11{"endIncluding":"r7.6"}
xx11r1
xx11r2
xx11r3
xx11r4
xx11r5
xx11r6
xx11r6.1
xx11r6.3
xx11r6.4
xx11r6.5.1
xx11r6.6
xx11r6.7
xx11r6.7.0
xx11r6.8.0
xx11r6.8.1
xx11r6.8.2
xx11r6.9.0
xx11r7.0
xx11r7.1
xx11r7.2
xx11r7.3
xx11r7.4
xx11r7.5

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.