{"id":"CVE-2022-25643","aliases":["DEBIAN-CVE-2022-25643","EUVD-2022-30303","GHSA-m93q-8wxv-xgc5","UBUNTU-CVE-2022-25643","openSUSE-SU-2024:11875-1"],"status":"published","title":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when...","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.021,"percentile":0.8183,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269","CWE-668"],"published":"2022-02-22T00:00:00Z","modified":"2026-10-28T10:27:53Z","fixes":[{"ecosystem":"Debian:12","package":"seatd","fixed_in":["0.6.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"seatd","fixed_in":["0.6.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"seatd","fixed_in":["0.6.4-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"seatd","fixed_in":["0.6.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"seatd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"seatd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"seatd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"seatd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4-1.1"}]}]}],"products":[{"vendor":"seatd_project","product":"seatd"}],"references":[{"url":"https://github.com/kennylevinsen/seatd/tags","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/kennylevinsen/seatd/compare/0.6.3...0.6.4","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://github.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416","tags":["x_transferred","fix"]},{"url":"https://github.com/kennylevinsen/seatd/commit/7cffe0797fdb17a9c08922339465b1b187394335","tags":["x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25643","tags":["x_transferred","advisory"]},{"url":"https://github.com/advisories/GHSA-m93q-8wxv-xgc5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25643.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-25643","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-25643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25643","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25643","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-25643","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"published","published":"2022-02-22T00:00:00Z","modified":"2024-08-03T04:42:50.299Z","updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-30303","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"published","published":"2022-02-22T00:00:00Z","modified":"2024-08-03T04:42:50Z","updated_at":"2026-11-03T03:25:46.499165Z"}],"ghsa":[{"id":"GHSA-m93q-8wxv-xgc5","title":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when...","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"published","published":"2022-02-25T00:01:01Z","modified":"2023-11-09T00:33:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269","CWE-668"],"updated_at":"2026-11-02T14:54:55.524004Z"}],"nvd":[{"id":"CVE-2022-25643","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"published","published":"2022-02-24T15:15:32.133Z","modified":"2026-06-17T04:33:49.463Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"DEBIAN-CVE-2022-25643","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"published","published":"2022-02-24T15:15:32.133Z","modified":"2026-11-03T08:02:46.334671124Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"UBUNTU-CVE-2022-25643","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"withdrawn","published":"2022-02-24T15:15:00Z","modified":"2026-02-10T07:15:21.121754Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-25643","description":"seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.","status":"published","published":"2022-02-22T00:00:00Z","modified":"2026-10-28T10:27:53.418051988Z","updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"openSUSE-SU-2024:11875-1","title":"libseat1-0.6.4-1.1 on GA media","description":"These are all security issues fixed in the libseat1-0.6.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:39.908759Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}