CVE-2006-4447

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
References
Link Resource
http://lists.freedesktop.org/archives/xorg/2006-June/016146.html Patch
http://mail.gnome.org/archives/beast/2006-December/msg00025.html
http://secunia.com/advisories/21650 Patch Vendor Advisory
http://secunia.com/advisories/21660
http://secunia.com/advisories/21693
http://secunia.com/advisories/22332
http://secunia.com/advisories/25032
http://secunia.com/advisories/25059
http://security.gentoo.org/glsa/glsa-200608-25.xml Patch Vendor Advisory
http://security.gentoo.org/glsa/glsa-200704-22.xml
http://www.debian.org/security/2006/dsa-1193
http://www.kb.cert.org/vuls/id/300368 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2006:160
http://www.securityfocus.com/bid/19742
http://www.securityfocus.com/bid/23697
http://www.vupen.com/english/advisories/2006/3409
http://www.vupen.com/english/advisories/2007/0409
http://lists.freedesktop.org/archives/xorg/2006-June/016146.html Patch
http://mail.gnome.org/archives/beast/2006-December/msg00025.html
http://secunia.com/advisories/21650 Patch Vendor Advisory
http://secunia.com/advisories/21660
http://secunia.com/advisories/21693
http://secunia.com/advisories/22332
http://secunia.com/advisories/25032
http://secunia.com/advisories/25059
http://security.gentoo.org/glsa/glsa-200608-25.xml Patch Vendor Advisory
http://security.gentoo.org/glsa/glsa-200704-22.xml
http://www.debian.org/security/2006/dsa-1193
http://www.kb.cert.org/vuls/id/300368 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2006:160
http://www.securityfocus.com/bid/19742
http://www.securityfocus.com/bid/23697
http://www.vupen.com/english/advisories/2006/3409
http://www.vupen.com/english/advisories/2007/0409
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:x.org:emu-linux-x87-xlibs:7.0_r1:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r6:6.7.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r6:6.8:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r6:6.8.1:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r6:6.8.2:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r7:1.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r7:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x11r7:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xdm:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xf86dga:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xinit:1.0.2_r5:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xload:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xorg-server:1.02_r5:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xterm:214:*:*:*:*:*:*:*

History

21 Nov 2024, 00:15

Type Values Removed Values Added
References () http://lists.freedesktop.org/archives/xorg/2006-June/016146.html - Patch () http://lists.freedesktop.org/archives/xorg/2006-June/016146.html - Patch
References () http://mail.gnome.org/archives/beast/2006-December/msg00025.html - () http://mail.gnome.org/archives/beast/2006-December/msg00025.html -
References () http://secunia.com/advisories/21650 - Patch, Vendor Advisory () http://secunia.com/advisories/21650 - Patch, Vendor Advisory
References () http://secunia.com/advisories/21660 - () http://secunia.com/advisories/21660 -
References () http://secunia.com/advisories/21693 - () http://secunia.com/advisories/21693 -
References () http://secunia.com/advisories/22332 - () http://secunia.com/advisories/22332 -
References () http://secunia.com/advisories/25032 - () http://secunia.com/advisories/25032 -
References () http://secunia.com/advisories/25059 - () http://secunia.com/advisories/25059 -
References () http://security.gentoo.org/glsa/glsa-200608-25.xml - Patch, Vendor Advisory () http://security.gentoo.org/glsa/glsa-200608-25.xml - Patch, Vendor Advisory
References () http://security.gentoo.org/glsa/glsa-200704-22.xml - () http://security.gentoo.org/glsa/glsa-200704-22.xml -
References () http://www.debian.org/security/2006/dsa-1193 - () http://www.debian.org/security/2006/dsa-1193 -
References () http://www.kb.cert.org/vuls/id/300368 - US Government Resource () http://www.kb.cert.org/vuls/id/300368 - US Government Resource
References () http://www.mandriva.com/security/advisories?name=MDKSA-2006:160 - () http://www.mandriva.com/security/advisories?name=MDKSA-2006:160 -
References () http://www.securityfocus.com/bid/19742 - () http://www.securityfocus.com/bid/19742 -
References () http://www.securityfocus.com/bid/23697 - () http://www.securityfocus.com/bid/23697 -
References () http://www.vupen.com/english/advisories/2006/3409 - () http://www.vupen.com/english/advisories/2006/3409 -
References () http://www.vupen.com/english/advisories/2007/0409 - () http://www.vupen.com/english/advisories/2007/0409 -

Information

Published : 2006-08-30 01:04

Updated : 2024-11-21 00:15


NVD link : CVE-2006-4447

Mitre link : CVE-2006-4447

CVE.ORG link : CVE-2006-4447


JSON object : View

Products Affected

x.org

  • emu-linux-x87-xlibs
  • xload
  • x11r6
  • xorg-server
  • xf86dga
  • x11r7
  • xdm
  • xinit
  • xterm