Vulnerability in KDE Arts
CVE-2006-2916
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (29.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 29.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- KDE Arts — versions 1.0, 1.2
- Linux Kernel
Weakness classification (CWE)
References
- www.vupen.com/english/advisories/2006/2357 (vdb-entry, Broken Link)
- secunia.com/advisories/20899 (Broken Link, Vendor Advisory, third-party-advisory)
- www.osvdb.org/26506 (vdb-entry, Broken Link)
- www.mandriva.com/security/advisories (vendor-advisory, Third Party Advisory)
- securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- www.gentoo.org/security/en/glsa/glsa-200606-22.xml (vendor-advisory, Third Party Advisory)
- secunia.com/advisories/20868 (Broken Link, Vendor Advisory, third-party-advisory)
- www.securityfocus.com/archive/1/437362/100/0/threaded (mailing-list, VDB Entry, Third Party Advisory, Broken Link)
- secunia.com/advisories/20786 (Broken Link, Vendor Advisory, third-party-advisory)
- security.gentoo.org/glsa/glsa-200704-22.xml (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2006-2916?
- CVE-2006-2916 is a high-severity vulnerability in KDE Arts, classified under Improper Check for Dropped Privileges. CVSS score: 7.8/10. Published 2006-06-15.
- How severe is CVE-2006-2916?
- High severity. CVSS v3 base score is 7.8 out of 10.