CVE-2011-1842

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-05-03 · updated 2026-06-16
Weakness: CWE-20

Description

dbus_backend/lsd.py in the D-Bus backend in language-selector before 0.6.7 does not validate the arguments to the (1) SetSystemDefaultLangEnv and (2) SetSystemDefaultLanguageEnv functions, which allows local users to gain privileges via shell metacharacters in a string argument, a different vulnerability than CVE-2011-0729.

Affected products

Ubuntu Language-Selector: through 0.6.6; 0.0+baz20050531, 0.0+baz20050609, 0.0+baz20050614, 0.0+baz20050808, 0.0+baz20050811, 0.0+baz20050819 (+106)

References

http://secunia.com/advisories/44214
http://www.securityfocus.com/bid/47502
http://www.ubuntu.com/usn/USN-1115-1/
http://www.ubuntuupdates.org/packages/show/307975
http://www.vupen.com/english/advisories/2011/1032
https://exchange.xforce.ibmcloud.com/vulnerabilities/67255
https://launchpad.net/bugs/764397
https://launchpad.net/ubuntu/+source/language-selector/0.6.7
http://secunia.com/advisories/44214
http://www.securityfocus.com/bid/47502
http://www.ubuntu.com/usn/USN-1115-1/
http://www.ubuntuupdates.org/packages/show/307975

Get alerted when CVE-2011-1842 or the next vulnerability affects your stack