{"id":"CVE-2022-37706","aliases":["DEBIAN-CVE-2022-37706","DLA-3115-1","DSA-5233-1","EUVD-2022-40320","GHSA-j268-37pf-rvx9","MGASA-2022-0360","UBUNTU-CVE-2022-37706","USN-8981-1","openSUSE-SU-2022:10153-1","openSUSE-SU-2024:12365-1"],"status":"published","title":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it...","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06006,"percentile":0.9338,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-269"],"published":"2022-09-19T00:00:00Z","modified":"2026-11-04T03:43:14Z","exploits":[{"source":"pocgithub","id":"MaherAzzouzi/CVE-2022-37706-LPE-exploit","title":"MaherAzzouzi/CVE-2022-37706-LPE-exploit","date":"2022-09-12","url":"https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit"},{"source":"metasploit","id":"exploit/linux/local/ubuntu_enlightenment_mount_priv_esc","title":"Ubuntu Enlightenment Mount Priv Esc","type":"exploit","platform":"Linux","date":"2022-09-13","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/ubuntu_enlightenment_mount_priv_esc"},{"source":"pocgithub","id":"ECU-10525611-Xander/CVE-2022-37706","title":"ECU-10525611-Xander/CVE-2022-37706","date":"2022-09-18","url":"https://github.com/ECU-10525611-Xander/CVE-2022-37706"},{"source":"exploitdb","id":"EDB-51180","title":"Enlightenment v0.25.3 - Privilege escalation","type":"local","platform":"linux","date":"2023-04-01","url":"https://www.exploit-db.com/exploits/51180"},{"source":"pocgithub","id":"junnythemarksman/CVE-2022-37706","title":"junnythemarksman/CVE-2022-37706","date":"2024-06-03","url":"https://github.com/junnythemarksman/CVE-2022-37706"},{"source":"pocgithub","id":"TACTICAL-HACK/CVE-2022-37706-SUID","title":"TACTICAL-HACK/CVE-2022-37706-SUID","date":"2024-07-19","url":"https://github.com/TACTICAL-HACK/CVE-2022-37706-SUID"},{"source":"pocgithub","id":"sanan2004/CVE-2022-37706","title":"sanan2004/CVE-2022-37706","date":"2024-08-18","url":"https://github.com/sanan2004/CVE-2022-37706"},{"source":"pocgithub","id":"KaoXx/CVE-2022-37706","title":"KaoXx/CVE-2022-37706","date":"2024-09-10","url":"https://github.com/KaoXx/CVE-2022-37706"},{"source":"pocgithub","id":"d3ndr1t30x/CVE-2022-37706","title":"d3ndr1t30x/CVE-2022-37706","date":"2024-12-10","url":"https://github.com/d3ndr1t30x/CVE-2022-37706"},{"source":"pocgithub","id":"Massive43/CVE-2022-37706","title":"Massive43/CVE-2022-37706","date":"2026-06-24","url":"https://github.com/Massive43/CVE-2022-37706"}],"fixes":[{"ecosystem":"Debian:12","package":"e17","fixed_in":["0.25.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"e17","fixed_in":["0.25.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"e17","fixed_in":["0.25.4-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"e17","fixed_in":["0.22.4-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"e17","fixed_in":["0.24.2-8+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"enlightenment","fixed_in":["0.24.2-2.1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"e17","fixed_in":["0.17.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"e17","fixed_in":["0.17.6-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"e17","fixed_in":["0.23.1-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"e17","fixed_in":["0.25.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"enlightenment","fixed_in":["0.25.4-bp154.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"enlightenment","fixed_in":["0.25.4-bp154.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.4-2+deb10u1"}]}],"versions":["0.22.4-2"]},{"source":"osv","ecosystem":"Debian:11","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.2-8+deb11u1"}]}],"versions":["0.24.2-8"]},{"source":"osv","ecosystem":"Mageia:8","package":"enlightenment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.2-2.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.6-1ubuntu0.1~esm1"}]}],"versions":["0.17.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.6-1.1ubuntu0.1~esm1"}]}],"versions":["0.17.6-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-4ubuntu0.1~esm1"}]}],"versions":["0.22.4-2","0.23.1-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.3-1ubuntu0.1~esm1"}]}],"versions":["0.24.2-8","0.25.1-1","0.25.3-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.6-1ubuntu0.1~esm1"}]}],"versions":["0.17.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.6-1.1ubuntu0.1~esm1"}]}],"versions":["0.17.6-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.1-4ubuntu0.1~esm1"}]}],"versions":["0.22.4-2","0.23.1-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"e17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.3-1ubuntu0.1~esm1"}]}],"versions":["0.24.2-8","0.25.1-1","0.25.3-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"enlightenment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4-bp154.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"enlightenment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.4-bp154.4.3.1"}]}]}],"products":[{"vendor":"enlightenment","product":"enlightenment"}],"references":[{"url":"https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit","tags":["x_transferred","Exploit","Third Party Advisory","evidence","advisory","report"]},{"url":"https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37706"},{"url":"https://github.com/advisories/GHSA-j268-37pf-rvx9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37706","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0360.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30868","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37706","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37706","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8981-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KO5BUW7UTM4YV552PWR2PTU3DCFBHLNY/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203631","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37706","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-37706","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-14T18:35:47.079Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-40320","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-14T18:35:47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:32.642133Z"}],"ghsa":[{"id":"GHSA-j268-37pf-rvx9","title":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it...","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T21:30:22Z","modified":"2023-01-28T05:01:32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:43:35.107967Z"}],"nvd":[{"id":"CVE-2022-37706","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T19:15:10.44Z","modified":"2026-06-17T04:55:11.273Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-37706","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T19:15:10.44Z","modified":"2026-04-16T04:34:38.205704695Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-37706","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T19:15:10.44Z","modified":"2026-11-03T08:03:54.587280405Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"UBUNTU-CVE-2022-37706","description":"enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.","status":"published","published":"2022-12-25T19:15:00Z","modified":"2026-11-04T03:30:05.09764878Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"DLA-3115-1","title":"e17 - security update","status":"published","published":"2022-09-19T00:00:00Z","modified":"2026-03-09T01:18:16.96281Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5233-1","title":"e17 - security update","status":"published","published":"2022-09-21T00:00:00Z","modified":"2026-03-09T02:09:08.770267Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0360","title":"Updated enlightenment packages fix security vulnerability","description":"Updated enlightenment package to fix the security vulnerability,\nCVE-2022-37706 that would allow an user to gain root privileges.\n","status":"published","published":"2022-10-08T20:22:22Z","modified":"2026-04-16T04:42:24.279870784Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:10153-1","title":"Security update for enlightenment","description":"This update for enlightenment fixes the following issues:\n\nUpdate to 0.25.4 Bugfix release\n\n* Fix shape handling in various cases that affected apps with shaped input\n* Fix procstats popup and dangling icon for fullscreen windows\n* Fix a vianishing pointer in some cases\n* Workaround Qt issue where it does not remove WM_STATE on withdraw\n* Fix fullscreen focus toggle flicker\n* Fix pointer sticking case\n* Fix tap-to-click props\n* Fix gadgcon disabled items\n* Fix config fallback handling that means no fallback happened\n* Fix gtk frame prop handling\n* Fix first map handling that affected energyxt\n* Fix CVE-2022-37706 (boo#1203631)\n* Harden enlightenment_sys when mis-packaged without sysactions.conf\n","status":"published","published":"2022-10-19T03:05:17Z","modified":"2026-02-04T02:34:39.542335Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12365-1","title":"enlightenment-0.25.4-1.1 on GA media","description":"These are all security issues fixed in the enlightenment-0.25.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:46.800746Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-8981-1","title":"e17 vulnerability","description":"It was discovered that the enlightenment_sys helper in Enlightenment\nincorrectly handled certain pathnames. A local attacker could possibly use\nthis issue to gain administrator privileges.","status":"published","published":"2026-11-03T17:35:21Z","modified":"2026-11-04T03:43:14.538424024Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}