PT-2006-6116 · X.Org · Libx11

Matthieu Herrb · Publicado 2006-11-03 · Atualizado 2017-07-20 · CVE-2006-5397

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions libX11 versions 1.0.2 through 1.0.3

Description The issue is related to a file descriptor leak in the Xinput module. This leak allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor. The leak occurs because the Xinput module opens a file for reading twice using the same file descriptor.

Recommendations For libX11 versions 1.0.2 and 1.0.3, consider restricting access to the XCOMPOSEFILE environment variable to minimize the risk of exploitation. As a temporary workaround, avoid using the XCOMPOSEFILE environment variable until a patch is available.

Correção

Identificadores relacionados

CVE-2006-5397

Produtos afetados

Libx11

Referências · 12

• http://secunia.com/advisories/22749 · Nota
• http://secunia.com/advisories/22642 · Aviso do Fabricante
• http://gitweb.freedesktop.org/?p=xorg/lib/libX11.git%3Ba=commit%3Bh=686bb8b35acf6cecae80fe89b2b5853f5816ce19 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5397 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4289 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29956 · Nota
• http://securityfocus.com/bid/20845 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-5397 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5397 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2006-5397 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2006:199 · Aviso do Fabricante
• https://bugs.freedesktop.org/show_bug.cgi?id=8699 · Correção