VDB
CVE-2006-4447
CVE-2006-4447
PUBLISHED
CVSS 7.199999809265137 HIGH
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
EPSS 0.13% · 32.3th percentile
Risk Scores
CVSS 2.0
7.199999809265137
EPSS Score
0.13%
32.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| x.org | emu-linux-x87-xlibs | 7.0_r1 |
| x.org | x11r7 | 1.0.2, 1.0, 1.0.1 |
| x.org | xorg-server | 1.02_r5 |
| x.org | xload | 1.0.0 |
| x.org | xterm | 214 |
| x.org | x11r6 | 6.8.1, 6.7.0, 6.8 |
| x.org | xdm | 1.0.3 |
| x.org | xf86dga | 1.0.0 |
| x.org | xinit | 1.0.2_r5 |
| n/a | n/a | n/a |
Timeline
- Aug 30, 2006 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 1, 2022 CVE Updated
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
References
- 21660 third-party-advisory
- MDKSA-2006:160 vendor-advisory
- [xorg] 20060620 X.Org security advisory: setuid return value check problems mailing-list
- VU#300368 third-party-advisory
- ADV-2006-3409 vdb
- 21693 third-party-advisory
- DSA-1193 vendor-advisory
- GLSA-200704-22 vendor-advisory
- 22332 third-party-advisory
- ADV-2007-0409 vdb
- GLSA-200608-25 vendor-advisory
- 23697 vdb
- 25059 third-party-advisory
- 25032 third-party-advisory
- [beast] 20061228 ANNOUNCE: BEAST/BSE v0.7.1 mailing-list
- 19742 vdb
- 21650 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2006-4447 advisory