Unscored severity · published Aug 30, 2006
CVE-2006-4447
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop…
–
CVSS
0.4%
EPSS
No
On KEV
Description
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Emu-linux-x87-xlibs · X.org
7.0_r1 · source: NVD
X1
X11r6 · X.org
6.7.0; 6.8; 6.8.1; 6.8.2 · source: NVD
X1
X11r7 · X.org
1.0; 1.0.1; 1.0.2 · source: NVD
XD
Xdm · X.org
1.0.3 · source: NVD
XF
Xf86dga · X.org
1.0.0 · source: NVD
XI
Xinit · X.org
1.0.2_r5 · source: NVD
XL
Xload · X.org
1.0.0 · source: NVD
XO
Xorg-server · X.org
1.02_r5 · source: NVD
XT
Xterm · X.org
214 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4447
Patch
http://lists.freedesktop.org/archives/xorg/2006-June/016146.html
mail.gnome.org
http://mail.gnome.org/archives/beast/2006-December/msg00025.html
Patch
http://secunia.com/advisories/21650
secunia.com
http://secunia.com/advisories/21660
secunia.com
http://secunia.com/advisories/21693
secunia.com
http://secunia.com/advisories/22332