A shell command injection flaw was found in the way the logrotate utility handled shred configuration directive (intended to ensure the log files are not readable after their scheduled deletion). A local attacker could use this flaw to execute arbitrary system commands (if the logrotate was run under privileged system user account, root) when the logrotate utility was run on a log file, within attacker controllable directory.

It was found that logrotate utility used insecure default permissions, when creating of new files (time-of-check, time-of-use, TOCTOU race condition). In some specific configurations, a local attacker could use this flaw to open the new file before the final permissions have been applied, leading to disclosure of sensitive information.

A denial of service flaw was found in the way the logrotate utility performed arguments sanitization, when performing the 'write state' action. A local attacker could use this flaw to cause abort in subsequent logrotate runs via a specially-crafted log file name.