CVE-2006-4447
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Affected
- x.org/emu-linux-x87-xlibs · x.org/x11r6 · x.org/x11r7 · x.org/xdm · x.org/xf86dga · x.org/xinit · x.org/xload · x.org/xorg-server · x.org/xterm
- Source
- cve@mitre.org
References
- http://lists.freedesktop.org/archives/xorg/2006-June/016146.htmlPatch
- http://mail.gnome.org/archives/beast/2006-December/msg00025.html
- http://secunia.com/advisories/21650Patch, Vendor Advisory
- http://secunia.com/advisories/21660
- http://secunia.com/advisories/21693
- http://secunia.com/advisories/22332
- http://secunia.com/advisories/25032
- http://secunia.com/advisories/25059
- http://security.gentoo.org/glsa/glsa-200608-25.xmlPatch, Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200704-22.xml
- http://www.debian.org/security/2006/dsa-1193
- http://www.kb.cert.org/vuls/id/300368US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:160
- http://www.securityfocus.com/bid/19742
- http://www.securityfocus.com/bid/23697
- http://www.vupen.com/english/advisories/2006/3409
- http://www.vupen.com/english/advisories/2007/0409
- http://lists.freedesktop.org/archives/xorg/2006-June/016146.htmlPatch
- http://mail.gnome.org/archives/beast/2006-December/msg00025.html
- http://secunia.com/advisories/21650Patch, Vendor Advisory
- http://secunia.com/advisories/21660
- http://secunia.com/advisories/21693
- http://secunia.com/advisories/22332
- http://secunia.com/advisories/25032
- http://secunia.com/advisories/25059
- http://security.gentoo.org/glsa/glsa-200608-25.xmlPatch, Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200704-22.xml
- http://www.debian.org/security/2006/dsa-1193
- http://www.kb.cert.org/vuls/id/300368US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:160
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.