VDB
CVE-2006-4447
CVE-2006-4447
PUBLISHED
CVSS 7.199999809265137 HIGH
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
EPSS 0.45% · 37.4th percentile
Risk Scores
CVSS 2.0
7.199999809265137
EPSS Score
0.45%
37.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| x.org | emu-linux-x87-xlibs | 7.0_r1 |
| x.org | x11r7 | 1.0.2, 1.0, 1.0.1 |
| x.org | xorg-server | 1.02_r5 |
| x.org | xload | 1.0.0 |
| x.org | xterm | 214 |
| x.org | x11r6 | 6.8.1, 6.7.0, 6.8 |
| x.org | xdm | 1.0.3 |
| x.org | xf86dga | 1.0.0 |
| x.org | xinit | 1.0.2_r5 |
| n/a | n/a | n/a |
Timeline
- Aug 30, 2006 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- May 27, 2023 EPSS Score
References
- MDKSA-2006:160 vendor-advisory
- [xorg] 20060620 X.Org security advisory: setuid return value check problems mailing-list
- DSA-1193 vendor-advisory
- GLSA-200704-22 vendor-advisory
- 22332 third-party-advisory
- ADV-2007-0409 vdb
- 23697 vdb
- 21660 third-party-advisory
- VU#300368 third-party-advisory
- ADV-2006-3409 vdb
- 21693 third-party-advisory
- GLSA-200608-25 vendor-advisory
- 25059 third-party-advisory
- 25032 third-party-advisory
- [beast] 20061228 ANNOUNCE: BEAST/BSE v0.7.1 mailing-list
- 19742 vdb
- 21650 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2006-4447 advisory