CVEvulnerability

CVE-2006-4447

7.2 HIGH Published 2006-08-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-08-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Affected configurations

• x.org emu-linux-x87-xlibs 7.0 r1 • x.org x11r6 6.7.0 • x.org x11r6 6.8 • x.org x11r6 6.8.1 • x.org x11r6 6.8.2 • x.org x11r7 1.0 • x.org x11r7 1.0.1 • x.org x11r7 1.0.2 • x.org xdm 1.0.3 • x.org xf86dga 1.0.0 • x.org xinit 1.0.2 r5 • x.org xload 1.0.0 • x.org xorg-server 1.02 r5 • x.org xterm 214

Related

Referenced by CWE · observed example (3)

  • CWE-252 Unchecked Return Value weakness
  • CWE-273 Improper Check for Dropped Privileges weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References