CVE-2011-4315

25

FAUCET Score

CVE-2011-4315 describes a heap-based buffer overflow in nginx versions prior to 1.0.10, specifically within the core/ngx_resolver.c component, affecting products like F5, Fedora, and SUSE. This vulnerability carries a CVSS score of 6.8, indicating a medium severity risk where a remote attacker could trigger a denial of service or potentially achieve other unspecified impacts through a crafted, long resolver response. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 0.6.18, < 1.0.10CPE matchmatch criteria	cpe:2.3:a:f5:nginx::::::::
		>= 1.1.0, <= 1.1.7CPE matchmatch criteria	cpe:2.3:a:f5:nginx::::::::
		16CPE matchmatch criteria	cpe:2.3:o:fedoraproject:fedora:16:::::::*
		1.2CPE matchmatch criteria	cpe:2.3:a:suse:studio:1.2::::standard:::
		1.2CPE matchmatch criteria	cpe:2.3:a:suse:studio_onsite:1.2:::::::*

CVSS Data

CVSS version used by this source: 2.0

6.8MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

6.4

CvssVersion

2.0

Exploit Intelligence

EPSS Score

5.96%

Probability of exploitation in next 30 days

EPSS Percentile

92.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

This CVE's current EPSS score of 0.0596 is in the 91st percentile among its peer group of 19,955 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

netgearpatch availablevia llm_extracted

Fixed in: 1.1.8+, 1.0.10+

opensshpatch availablevia llm_extracted

Fixed in: 1.1.8

power_bipatch availablevia llm_extracted

Fixed in: 1.0.10

terraformpatch availablevia llm_extracted

Fixed in: 1.1.8

dahuavendor investigatingvia llm_extracted

Fixed in: 1.0.10+

dfinityvendor investigatingvia llm_extracted

Fixed in: 1.1.8

jfrogvendor investigatingvia llm_extracted

Fixed in: 1.1.8

liferayvendor investigatingvia llm_extracted

Fixed in: 1.0.10

Vendor Advisories (8)

dfinityllm-dfinity-6d5811957d389dcbMEDIUM

Buffer overflow in resolver

power_billm-power_bi-f4e0a80c7163c876MEDIUM

Buffer overflow in resolver

jfrogllm-jfrog-c134c56e44a12897MEDIUM

Buffer overflow in resolver

opensshllm-openssh-97d0512c3fa47aa0MEDIUM

Buffer overflow in resolver

dahuallm-dahua-2bb0ade8f8f8bf40MEDIUM

Buffer overflow in resolver

terraformllm-terraform-4b9ab1c8f3c58535MEDIUM

Buffer overflow in resolver

netgearllm-netgear-502ec6d1010f4fbeMEDIUM

Buffer overflow in resolver

liferayllm-liferay-ac215ba876da5793MEDIUM

Buffer overflow in resolver

References

lists.fedoraproject.org / pipermail/package-announce/2011-December/070569.html

Third Party Advisory

lists.opensuse.org / opensuse-security-announce/2011-12/msg00005.html

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2011/11/17/10

Mailing ListPatchThird Party Advisory

openwall.com / lists/oss-security/2011/11/17/8

Mailing ListPatchThird Party Advisory

secunia.com / advisories/47097

Third Party Advisory

secunia.com / advisories/48577

Third Party Advisory

security.gentoo.org / glsa/glsa-201203-22.xml

Third Party Advisory

trac.nginx.org / nginx/changeset/4268/nginx

Issue TrackingPatchVendor Advisory

nginx.org / en/CHANGES-1.0

Release NotesVendor Advisory

securityfocus.com / bid/50710

Third Party AdvisoryVDB Entry