CVE-2009-1573

2009-05-0617:30:09

Debian Security Bug Tracker

security-tracker.debian.org

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.1%

JSON

xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments.

OSVersionArchitecturePackageVersionFilename
Debian12allxorg-server< 2:1.6.1.901-3xorg-server_2:1.6.1.901-3_all.deb
Debian11allxorg-server< 2:1.6.1.901-3xorg-server_2:1.6.1.901-3_all.deb
Debian10allxorg-server< 2:1.6.1.901-3xorg-server_2:1.6.1.901-3_all.deb
Debian999allxorg-server< 2:1.6.1.901-3xorg-server_2:1.6.1.901-3_all.deb
Debian13allxorg-server< 2:1.6.1.901-3xorg-server_2:1.6.1.901-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	xorg-server	< 2:1.6.1.901-3	xorg-server_2:1.6.1.901-3_all.deb
Debian	11	all	xorg-server	< 2:1.6.1.901-3	xorg-server_2:1.6.1.901-3_all.deb
Debian	10	all	xorg-server	< 2:1.6.1.901-3	xorg-server_2:1.6.1.901-3_all.deb
Debian	999	all	xorg-server	< 2:1.6.1.901-3	xorg-server_2:1.6.1.901-3_all.deb
Debian	13	all	xorg-server	< 2:1.6.1.901-3	xorg-server_2:1.6.1.901-3_all.deb