CVE-2011-4357

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-12-10 · updated 2026-06-16
Weakness: CWE-134

Description

Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.

Affected products

Brandon Long Clearsilver: through 0.10.5; 0.1, 0.2, 0.2.1, 0.3, 0.4, 0.5 (+17)

References

http://code.google.com/p/clearsilver/source/detail?r=919
http://osvdb.org/77419
http://secunia.com/advisories/47016
http://tech.groups.yahoo.com/group/ClearSilver/message/1422
http://www.debian.org/security/2011/dsa-2355
http://www.openwall.com/lists/oss-security/2011/11/27/1
https://exchange.xforce.ibmcloud.com/vulnerabilities/71599
http://code.google.com/p/clearsilver/source/detail?r=919
http://osvdb.org/77419
http://secunia.com/advisories/47016
http://tech.groups.yahoo.com/group/ClearSilver/message/1422
http://www.debian.org/security/2011/dsa-2355

Get alerted when CVE-2011-4357 or the next vulnerability affects your stack