CVE-2006-4447
CVE-2006-4447
This page contains facts from public vulnerability sources. Check the original advisory before updating.
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
libx11 Debian:12
- Affected ranges
- ECOSYSTEM: < 2:1.0.0-7
Update to 2:1.0.0-7
libx11 Debian:13
- Affected ranges
- ECOSYSTEM: < 2:1.0.0-7
Update to 2:1.0.0-7
libx11 Debian:14
- Affected ranges
- ECOSYSTEM: < 2:1.0.0-7
Update to 2:1.0.0-7
xdm Debian:12
- Affected ranges
- ECOSYSTEM: < 1:1.0.5-1
Update to 1:1.0.5-1
xdm Debian:13
- Affected ranges
- ECOSYSTEM: < 1:1.0.5-1
Update to 1:1.0.5-1
xdm Debian:14
- Affected ranges
- ECOSYSTEM: < 1:1.0.5-1
Update to 1:1.0.5-1
xorg-server Debian:12
- Affected ranges
- ECOSYSTEM: < 1:1.0.2-9
Update to 1:1.0.2-9
xorg-server Debian:13
- Affected ranges
- ECOSYSTEM: < 1:1.0.2-9
Update to 1:1.0.2-9
xorg-server Debian:14
- Affected ranges
- ECOSYSTEM: < 1:1.0.2-9
Update to 1:1.0.2-9
xterm Debian:12
- Versions
- 379-1
- 380-1
- 381-1
- 382-1
- 382-2
- 383-1
- 384-1
- 385-1
- 386-1
- 387-1
- 388-1
- 389-1
- 390-1
- 391-1
- 392-1
- 393-1
- 394-1
- 395-1
- 396-1
- 397-1
- 398-1
- 399-1
- 401-1
- 402-1
- 403-1
- 404-1
- 405-1
- 406-1
- 407-1
- 409-1
- 410-1
- 411-1
- 412-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xterm Debian:13
- Versions
- 398-1
- 399-1
- 401-1
- 402-1
- 403-1
- 404-1
- 405-1
- 406-1
- 407-1
- 409-1
- 410-1
- 411-1
- 412-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xterm Debian:14
- Versions
- 398-1
- 399-1
- 401-1
- 402-1
- 403-1
- 404-1
- 405-1
- 406-1
- 407-1
- 409-1
- 410-1
- 411-1
- 412-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xtrans Debian:12
- Affected ranges
- ECOSYSTEM: < 1.0.0-6
Update to 1.0.0-6
xtrans Debian:13
- Affected ranges
- ECOSYSTEM: < 1.0.0-6
Update to 1.0.0-6
xtrans Debian:14
- Affected ranges
- ECOSYSTEM: < 1.0.0-6
Update to 1.0.0-6
Original sources
- http://secunia.com/advisories/21660
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:160
- http://lists.freedesktop.org/archives/xorg/2006-June/016146.html
- http://www.kb.cert.org/vuls/id/300368
- http://www.vupen.com/english/advisories/2006/3409
- http://secunia.com/advisories/21693
- http://www.debian.org/security/2006/dsa-1193
- http://security.gentoo.org/glsa/glsa-200704-22.xml
- http://secunia.com/advisories/22332
- http://www.vupen.com/english/advisories/2007/0409
- http://security.gentoo.org/glsa/glsa-200608-25.xml
- http://www.securityfocus.com/bid/23697
- http://secunia.com/advisories/25059
- http://secunia.com/advisories/25032
- http://mail.gnome.org/archives/beast/2006-December/msg00025.html
- http://www.securityfocus.com/bid/19742
- http://secunia.com/advisories/21650
- https://nvd.nist.gov/vuln/detail/CVE-2006-4447