Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-4447

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Published

2006-08-30T01:04:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.2 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application x.org emu-linux-x87-xlibs 7.0_r1 Yes
Application x.org x11r6 6.7.0 Yes
Application x.org x11r6 6.8 Yes
Application x.org x11r6 6.8.1 Yes
Application x.org x11r6 6.8.2 Yes
Application x.org x11r7 1.0 Yes
Application x.org x11r7 1.0.1 Yes
Application x.org x11r7 1.0.2 Yes
Application x.org xdm 1.0.3 Yes
Application x.org xf86dga 1.0.0 Yes
Application x.org xinit 1.0.2_r5 Yes
Application x.org xload 1.0.0 Yes
Application x.org xorg-server 1.02_r5 Yes
Application x.org xterm 214 Yes
References