ID CVE-2006-5969
Summary CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name, which is not properly handled by fvwm-menu-directory, a variant of CVE-2003-1308.
References
Vulnerable Configurations
  • cpe:2.3:a:fvwm:fvwm:*:*:*:*:*:*:*:*
    cpe:2.3:a:fvwm:fvwm:*:*:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 20-07-2017 - 01:34)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
refmap via4
confirm http://thread.gmane.org/gmane.comp.window-managers.fvwm.devel/2419/focus=2419
gentoo GLSA-200611-17
misc http://www.gentoo-portage.com/x11-wm/fvwm/ChangeLog
secunia
  • 22961
  • 23089
xf fvwm-evalfolderline-command-execution(30452)
statements via4
contributor Mark J Cox
lastmodified 2006-11-22
organization Red Hat
statement Not vulnerable. Red Hat Enterprise Linux 2.1 shipped with fvwm, however this issue does not affect the included version of fvwm.
Last major update 20-07-2017 - 01:34
Published 17-11-2006 - 23:07
Last modified 20-07-2017 - 01:34
Back to Top