What’s Vulnerable › Vulnerabilities

CVE-2009-1186

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-04-17 · updated 2026-06-16
• Weakness: CWE-120

Description

Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.

Affected products

• Canonical Ubuntu Linux: 6.06, 7.10, 8.04, 8.10
• Debian Linux: 4.0, 5.0
• Fedoraproject Fedora: 9, 10
• Opensuse: 10.3, 11.0, 11.1
• SUSE Linux Enterprise Debuginfo: 10-sp2, 11
• SUSE Linux Enterprise Server 15 SP1: 10-sp2, 11
• SUSE Linux Enterprise Server: 10-sp2, 11
• Udev Project Udev: before 141 — fixed in 141

How to fix

Upgrade to a fixed version: Udev Project Udev 141. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=662c3110803bd8c1aedacc36788e6fd028944314
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.html
• http://secunia.com/advisories/34731
• http://secunia.com/advisories/34750
• http://secunia.com/advisories/34753
• http://secunia.com/advisories/34771
• http://secunia.com/advisories/34776
• http://secunia.com/advisories/34785
• http://secunia.com/advisories/34787
• http://secunia.com/advisories/34801
• http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.446399
• http://wiki.rpath.com/Advisories:rPSA-2009-0063

Get alerted when CVE-2009-1186 or the next vulnerability affects your stack