CVSS: 2.6EPSS: 0%CPEs: 54EXPL: 0CVE-2006-5215
https://notcve.org/view.php?id=CVE-2006-5215
The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file. La secuencia de comandos Xsession, tambien usado por X Display Manager (xdm) en NetBSD anterior a 12/02/2006, X.Org anterior a 17/03/2006, y Solaris 8 hasta la 10 anterior a 06/10/2006, permiten a un usuario local sobre escribir archivos de su elección, o leer otros ficheros de errores de usuarios de Xsession, a través de un ataque de enlaces simbólicos sobre un archivo/tmp/xses-$USER. • http://secunia.com/advisories/22992 http://securitytracker.com/id?1017015 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102652-1 http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=32805 https://bugs.freedesktop.org/show_bug.cgi?id=5898 https://exchange.xforce.ibmcloud.com/vulnerabilities/29427 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2205 •
CVSS: 7.2EPSS: 0%CPEs: 14EXPL: 0CVE-2006-4447
https://notcve.org/view.php?id=CVE-2006-4447
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit. X.Org y XFree86, incluyendo libX11, xdm, xf86dga, xinit, xload, xtrans, y xterm, no comprueban los valores de retorno de las llamadas a setuid y seteuid al intentar eliminar privilegios, lo cual permite a usuarios locales obtener privilegios haciendo fallar estas llamadas, como por ejemplo excediendo un ulimit. • http://lists.freedesktop.org/archives/xorg/2006-June/016146.html http://mail.gnome.org/archives/beast/2006-December/msg00025.html http://secunia.com/advisories/21650 http://secunia.com/advisories/21660 http://secunia.com/advisories/21693 http://secunia.com/advisories/22332 http://secunia.com/advisories/25032 http://secunia.com/advisories/25059 http://security.gentoo.org/glsa/glsa-200608-25.xml http://security.gentoo.org/glsa/glsa-200704-22.xml http://www.debian.org/securit •
CVSS: 7.5EPSS: 2%CPEs: 3EXPL: 0CVE-2004-0419
https://notcve.org/view.php?id=CVE-2004-0419
XDM in XFree86 opens a chooserFd TCP socket even when DisplayManager.requestPort is 0, which could allow remote attackers to connect to the port, in violation of the intended restrictions. XDM en XFree86 abre una un socket TCP chooserFd incluso cuando DisplayManger.requestPort es 0, lo que podría permitir a atacantes remotos conectar al puerto, violando las restricciones pretendidas. • http://bugs.xfree86.org/show_bug.cgi?id=1376 http://secunia.com/advisories/12019 http://securitytracker.com/id?1010306 http://www.ciac.org/ciac/bulletins/p-001.shtml http://www.gentoo.org/security/en/glsa/glsa-200407-05.xml http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:073 http://www.openbsd.org/errata.html#xdm http://www.redhat.com/support/errata/RHSA-2004-478.html http://www.securityfocus.com/bid/10423 https://bugzilla.redhat.com/bugz •