CVE-2006-2916: kde arts Improper Check for Dropped Privileges

CVSS: 7.8v3.1HighModified

Published 15-06-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-2916 is a high (CVSS 7.8) Improper Check for Dropped Privileges vulnerability in kde arts. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

0.39%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

15-06-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.

CVSS metrics

2 scores · 1 source · 2 versions

v3.17.8v2.06.0

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

0.00 pp

From 0.39% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-273Improper Check for Dropped PrivilegesThe product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

Affected systems

Kde1 product

arts1.0 | 1.2

1 vendor · 1 product

References

23 links

www.vupen.com/english/advisories/2006/2357VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/20899Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.osvdb.org/26506VDB EntryX Refsource OSVDBBroken Link
www.mandriva.com/security/advisories?name=MDKSA-2006:107Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
securitytracker.com/id?1016298VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.gentoo.org/security/en/glsa/glsa-200606-22.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/20868Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.securityfocus.com/archive/1/437362/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/20786Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
security.gentoo.org/glsa/glsa-200704-22.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory

Show all 23 references

www.vupen.com/english/advisories/2007/0409VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/20677Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.securityfocus.com/bid/23697VDB EntryX Refsource BIDBroken LinkThird Party Advisory
secunia.com/advisories/25059Third Party AdvisoryX Refsource SECUNIABroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/27221VDB EntryX Refsource XFThird Party Advisory
secunia.com/advisories/20827Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.novell.com/linux/security/advisories/2006_38_security.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/25032Third Party AdvisoryX Refsource SECUNIABroken Link
www.kde.org/info/security/advisory-20060614-2.txtX Refsource CONFIRMPatchVendor Advisory
mail.gnome.org/archives/beast/2006-December/msg00025.htmlMailing ListX Refsource MLIST
dot.kde.org/1150310128/X Refsource CONFIRMNot Applicable
www.securityfocus.com/bid/18429VDB EntryX Refsource BIDBroken LinkPatchThird Party Advisory
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.468256Vendor AdvisoryX Refsource SLACKWAREMailing ListThird Party Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities