Every CVE Search/ Get API key

CVE-2006-4447

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not...

7.2 HighFix available

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Exploit likelihood

0.45%Down 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Record
CVE-2006-4447
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Record
CVE-2006-4447
Updated
2026-11-02
EUVDEUVD-2006-4435 No score

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Record
EUVD-2006-4435
Updated
2026-11-03
GitHub AdvisoriesGHSA-3cp9-g7w3-6jqq No score

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not...

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Record
GHSA-3cp9-g7w3-6jqq
Updated
2026-11-02
OSV No score

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Record
CVE-2006-4447
Updated
2026-11-02
OSVDEBIAN-CVE-2006-4447 No score

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

Record
DEBIAN-CVE-2006-4447
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libx11
Debian:12
 before 2:1.0.0-7
2:1.0.0-7
libx11
Debian:13
 before 2:1.0.0-7
2:1.0.0-7
libx11
Debian:14
 before 2:1.0.0-7
2:1.0.0-7
xdm
Debian:12
 before 1:1.0.5-1
1:1.0.5-1
xdm
Debian:13
 before 1:1.0.5-1
1:1.0.5-1
xdm
Debian:14
 before 1:1.0.5-1
1:1.0.5-1
xorg-server
Debian:12
 before 1:1.0.2-9
1:1.0.2-9
xorg-server
Debian:13
 before 1:1.0.2-9
1:1.0.2-9
xorg-server
Debian:14
 before 1:1.0.2-9
1:1.0.2-9
xterm
Debian:12
 All versions, plus listed versions
379-1380-1381-1382-1382-2
Show 28 moreShow less
383-1384-1385-1386-1387-1388-1389-1390-1391-1392-1393-1394-1395-1396-1397-1398-1399-1401-1402-1403-1404-1405-1406-1407-1409-1410-1411-1412-1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
xterm
Debian:13
 All versions, plus listed versions
398-1399-1401-1402-1403-1
Show 8 moreShow less
404-1405-1406-1407-1409-1410-1411-1412-1
 None known
xterm
Debian:14
 All versions, plus listed versions
398-1399-1401-1402-1403-1
Show 8 moreShow less
404-1405-1406-1407-1409-1410-1411-1412-1
 None known
xtrans
Debian:12
 before 1.0.0-6
1.0.0-6
xtrans
Debian:13
 before 1.0.0-6
1.0.0-6
xtrans
Debian:14
 before 1.0.0-6
1.0.0-6
xfree86
Debian:3.1
From an advisory covering 4 CVEs
 before 4.3.0.dfsg.1-14sarge2, plus listed versions
4.3.0.dfsg.1-144.3.0.dfsg.1-14sarge1
4.3.0.dfsg.1-14sarge2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-4447 is a high vulnerability (CVSS 7.2) in X.org Xdm, published August 30, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in libx11 2:1.0.0-7.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open