CVE-2011-4862

CVE-2011-4862 is a critical-severity vulnerability in Freebsd with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 95% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-120.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 95% (100th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-120
• Affected product: Freebsd
• Published: 2011-12-25
• Last modified: 2026-06-16

Description

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

Frequently asked questions

What is CVE-2011-4862?

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

How severe is CVE-2011-4862?

CVE-2011-4862 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2011-4862 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 95% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2011-4862?

CVE-2011-4862 primarily affects Freebsd. In total, 21 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2011-4862?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2011-4862 published?

CVE-2011-4862 was published on 2011-12-25 and last updated on 2026-06-16.

References

• http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html
• http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
• http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html
• http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html
• http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html
• http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html
• http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html
• http://osvdb.org/78020
• http://secunia.com/advisories/46239
• http://secunia.com/advisories/47341
• http://secunia.com/advisories/47348
• http://secunia.com/advisories/47357
• http://secunia.com/advisories/47359
• http://secunia.com/advisories/47373
• http://secunia.com/advisories/47374
• http://secunia.com/advisories/47397
• http://secunia.com/advisories/47399
• http://secunia.com/advisories/47441
• http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc
• http://security.freebsd.org/patches/SA-11:08/telnetd.patch
• http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt

Affected products (21)

• cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*
• cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*
• cpe:2.3:a:mit:krb5-appl:*:*:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
• cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
• cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*
• cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:-:vmware:*:*
• cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*
• cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*

More vulnerabilities in Freebsd

• CVE-2024-43102 — Critical (CVSS 10.0): Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of…
• CVE-2018-17160 — Critical (CVSS 10.0): In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models…
• CVE-2014-3954 — Critical (CVSS 10.0): Stack-based buffer overflow in rtsold in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of…
• CVE-2006-4304 — Critical (CVSS 10.0): Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and…
• CVE-2006-0226 — Critical (CVSS 10.0): Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for…
• CVE-2005-0708 — Critical (CVSS 10.0): The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 can transfer portions of kernel memory if a file…

All CVEs affecting Freebsd →

Other CWE-120 (Classic Buffer Overflow) vulnerabilities

• CVE-2025-48611 — Critical (CVSS 10.0): In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead…
• CVE-2026-24823 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in FASTSHIFT…
• CVE-2026-24810 — Critical (CVSS 10.0): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules).…
• CVE-2026-24800 — Critical (CVSS 10.0): Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow…
• CVE-2025-9962 — Critical (CVSS 10.0): A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior…
• CVE-2010-10016 — Critical (CVSS 10.0): BS.Player version 2.57 (build 1051) contains a vulnerability in its playlist import functionality. When processing .m3u…

Browse all CWE-120 (Classic Buffer Overflow) vulnerabilities →