CVE-2006-5051: apple mac_os_x Double Free

Modified

AliasesDEBIAN-CVE-2006-5051

Published 27-09-2006Last modified 07-08-2024

Some data may be incomplete

2 references with an unsupported link type were hidden.

Vulnerability summary

CVE-2006-5051 is a high (CVSS 9.3) Double Free vulnerability in apple mac_os_x. EPSS estimates a 45.59% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 46% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

45.59%

0%100%

High · +0.63 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6

DSA-1189-1 DSA-1212 DSA-1212-1 DSA-1638-1 RHSA-2006:0697 RHSA-2006:0698

Timeline

27-09-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.18.1v2.09.3

EPSS trend

Probability

45.59%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Increase +0.63 pp

From 44.96% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-415Double FreeThe product calls free() twice on the same memory address.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Apple2 products

mac_os_x< 10.3.9 | ≥ 10.4, ≤ 10.4.8
mac_os_x_server< 10.3.9 | ≥ 10.4, ≤ 10.4.8

Debian2 products

openssh< 1:4.6p1-1
debian_linuxEOL3.1

Openbsd1 product

openssh≤ 4.4

3 vendors · 5 products

References

57 links

security.freebsd.org/advisories/FreeBSD-SA-06%3A22.openssh.ascVendor AdvisoryThird Party Advisory
sourceforge.net/forum/forum.php?forum_id=681763Broken Link
secunia.com/advisories/22270Third Party AdvisoryBroken LinkVendor Advisory
www.arkoon.fr/upload/alertes/43AK-2006-09-FR-1.0_SSL360_OPENSSH.pdfBroken Link
www.ubuntu.com/usn/usn-355-1Vendor AdvisoryBroken Link
lists.freebsd.org/pipermail/freebsd-security/2006-October/004051.htmlMailing List
www.vmware.com/support/vi3/doc/esx-3069097-patch.htmlBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11387VDB EntrySignatureBroken Link
openssh.org/txt/release-4.4Release Notes
secunia.com/advisories/24805Third Party AdvisoryBroken LinkVendor Advisory

Show all 57 references

www.kb.cert.org/vuls/id/851340Third Party AdvisoryUS Government Resource
www.openbsd.org/errata.htmlVendor AdvisoryRelease Notes
secunia.com/advisories/22487Third Party AdvisoryBroken LinkVendor Advisory
www.us-cert.gov/cas/techalerts/TA07-072A.htmlThird Party AdvisoryUS Government Resource
www.arkoon.fr/upload/alertes/36AK-2006-07-FR-1.0_FAST360_OPENSSH.pdfBroken Link
security.gentoo.org/glsa/glsa-200611-06.xmlVendor AdvisoryThird Party Advisory
www.novell.com/linux/security/advisories/2006_62_openssh.htmlVendor AdvisoryBroken Link
secunia.com/advisories/22362Third Party AdvisoryBroken LinkVendor Advisory
secunia.com/advisories/23680Third Party AdvisoryBroken LinkVendor Advisory
lists.apple.com/archives/security-announce/2007/Mar/msg00002.htmlVendor AdvisoryMailing List
docs.info.apple.com/article.html?artnum=305214Broken Link
secunia.com/advisories/22352Third Party AdvisoryBroken LinkVendor Advisory
www.vupen.com/english/advisories/2006/4329VDB EntryBroken Link
secunia.com/advisories/22236Third Party AdvisoryBroken LinkVendor Advisory
secunia.com/advisories/24799Third Party AdvisoryBroken LinkVendor Advisory
www.vupen.com/english/advisories/2006/4018VDB EntryBroken Link
secunia.com/advisories/22495Third Party AdvisoryBroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/29254VDB EntryThird Party Advisory
www.securityfocus.com/bid/20241VDB EntryBroken LinkThird Party Advisory
www.vupen.com/english/advisories/2007/1332VDB EntryBroken Link
www.osvdb.org/29264VDB EntryBroken Link
secunia.com/advisories/22823Third Party AdvisoryBroken LinkVendor Advisory
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.592566Vendor AdvisoryBroken Link
www.redhat.com/support/errata/RHSA-2006-0697.htmlVendor AdvisoryBroken Link
www.openpkg.org/security/advisories/OpenPKG-SA-2006.022-openssh.htmlVendor AdvisoryBroken Link
secunia.com/advisories/22183Third Party AdvisoryBroken LinkVendor Advisory
marc.info?l=openssh-unix-dev&m=115939141729160&w=2Mailing List
www.vupen.com/english/advisories/2007/0930VDB EntryBroken Link
www-unix.globus.org/mail_archive/security-announce/2007/04/msg00000.htmlMailing ListBroken Link
secunia.com/advisories/22926Third Party AdvisoryBroken LinkVendor Advisory
secunia.com/advisories/22173Third Party AdvisoryBroken LinkVendor Advisory
securitytracker.com/id?1016940VDB EntryBroken LinkThird Party Advisory
secunia.com/advisories/22208Third Party AdvisoryBroken LinkVendor Advisory
www.vmware.com/support/vi3/doc/esx-9986131-patch.htmlBroken Link
secunia.com/advisories/22245Third Party AdvisoryBroken LinkVendor Advisory
secunia.com/advisories/22196Third Party AdvisoryBroken LinkVendor Advisory
www.debian.org/security/2006/dsa-1212Vendor AdvisoryBroken Link
www.redhat.com/support/errata/RHSA-2006-0698.htmlVendor AdvisoryBroken Link
secunia.com/advisories/22158Third Party AdvisoryBroken LinkVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:179Vendor AdvisoryThird Party Advisory
www.debian.org/security/2006/dsa-1189Vendor AdvisoryMailing List
support.avaya.com/elmodocs2/security/ASA-2006-216.htmThird Party Advisory
secunia.com/advisories/24479Third Party AdvisoryBroken LinkVendor Advisory
www.openwall.com/lists/oss-security/2024/07/01/3Mailing List
www.openwall.com/lists/oss-security/2024/07/28/3Mailing List
www.openwall.com/lists/oss-security/2024/07/28/3
security-tracker.debian.org/tracker/CVE-2006-5051Advisory