Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.
avahi.org/milestone/Avahi%200.6.15
secunia.com/advisories/22807
secunia.com/advisories/22852
secunia.com/advisories/22932
secunia.com/advisories/23020
secunia.com/advisories/23042
securitytracker.com/id?1017257
www.gentoo.org/security/en/glsa/glsa-200611-13.xml
www.mandriva.com/security/advisories?name=MDKSA-2006:215
www.novell.com/linux/security/advisories/2006_26_sr.html
www.securityfocus.com/bid/21016
www.vupen.com/english/advisories/2006/4474
exchange.xforce.ibmcloud.com/vulnerabilities/30207
tango.0pointer.de/pipermail/avahi-tickets/2006-November/000320.html
usn.ubuntu.com/380-1/