CVE-2011-1075

Name: CVE-2011-1075
Creator: NVD / NIST
Published: 2021-10-19T15:15:07.41+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 3.7/10EPSS 0.73%

Last modified Jun 16, 2026

CVE-2011-1075 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. EPSS estimates a 0.73% chance of exploitation in the next 30 days.

Description

FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.

Metrics

CVSS 3.1

3.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability

0.73%

49.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Freebsd	Freebsd	All versions

References

https://marc.info/?l=full-disclosure&m=129891323028897&w=2Third Party Advisory
https://security.netapp.com/advisory/ntap-20211125-0004/Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/02/28/14Mailing List, Third Party Advisory
https://marc.info/?l=full-disclosure&m=129891323028897&w=2Third Party Advisory
https://security.netapp.com/advisory/ntap-20211125-0004/Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/02/28/14Mailing List, Third Party Advisory

Timeline

Published: Oct 19, 2021
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2011-1075?

How severe is CVE-2011-1075?

CVE-2011-1075 has a CVSS score of 3.7/10 (LOW severity). The EPSS model estimates a 0.73% probability of exploitation in the next 30 days.

How do I fix CVE-2011-1075?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2011-1075?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST