Unscored severity · published Nov 14, 2006
CVE-2006-5461
Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof…
–
CVSS
0.4%
EPSS
No
On KEV
Description
Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Avahi · Avahi
through 0.6.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5461
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5461
avahi.org
http://avahi.org/milestone/Avahi%200.6.15
Patch
http://secunia.com/advisories/22807
Patch
http://secunia.com/advisories/22852
secunia.com
http://secunia.com/advisories/22932
secunia.com
http://secunia.com/advisories/23020
secunia.com
http://secunia.com/advisories/23042
More from Avahi
9.1
CVE-2017-6519
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a…
7.8
CVE-2021-26720
avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of…
6.5
CVE-2026-24401
Avahi has Uncontrolled Recursion in lookup_handle_cname function
6.5
CVE-2025-68471
Avahi has a reachable assertion in lookup_start
6.5
CVE-2025-68468
Avahi has a reachable assertion in lookup_multicast_callback