Unscored severity · published Feb 11, 2006
CVE-2006-0646
ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute…
–
CVSS
0.4%
EPSS
No
On KEV
Description
ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Suse Linux · Suse
9.0; 9.1; 9.1; 9.1; 9.2; 9.2; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0646
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0646
Patch
http://lists.suse.com/archive/suse-security-announce/2006-Feb/0003.html
secunia.com
http://secunia.com/advisories/18811
www.securityfocus.com
http://www.securityfocus.com/bid/16581
More from Suse Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
9.8
CVE-1999-0426
The default permissions of /dev/kmem in Linux versions before 2.0.36 allows IP spoofing
8.2
CVE-2017-3224
Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber
7.8
CVE-2004-0940
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via…
7.5
CVE-2024-12087
Rsync: path traversal vulnerability in rsync