artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade kde-base/arts.Upgrade media-sound/beast. | Oct 30, 2017 | Jun 15, 2006 |
| Suse | — | Upgrade qt3-unixODBC-64bitUpgrade mysql-shared-x86Upgrade kdelibs3-arts-32bitUpgrade esound-x86Upgrade kdebase3-x86Upgrade net-snmp-devel-64bitUpgrade fontconfig-devel-32bitUpgrade qt3-mysql-64bitUpgrade net-snmp-32bitUpgrade fontconfig-develUpgrade libwnck-develUpgrade fontconfig-devel-64bitUpgrade net-snmp-64bitUpgrade kdelibs3Upgrade mysql-shared-64bitUpgrade kdelibs3-arts-x86Upgrade mysql-shared-32bitUpgrade fontconfigUpgrade kdebase3-32bitUpgrade gtk-x86Upgrade arts-x86Upgrade arts-64bitUpgrade qt3-develUpgrade gtk-develUpgrade kdebase3-sessionUpgrade esound-32bitUpgrade kdelibs3-64bitUpgrade arts-gmcopUpgrade artsUpgrade perl-SNMPUpgrade qt3-postgresql-64bitUpgrade qt3-manUpgrade mysql-clientUpgrade libwnck-x86Upgrade qt3-mysqlUpgrade gnokiiUpgrade kdebase3Upgrade fontconfig-x86Upgrade qt3-devel-32bitUpgrade kdelibs3-arts-64bitUpgrade esoundUpgrade mysql-sharedUpgrade kdebase3-nspluginUpgrade mysqlUpgrade qt3-devel-64bitUpgrade kdelibs3-docUpgrade qt3-32bitUpgrade kdebase3-kdmUpgrade kdebase3-64bitUpgrade esound-develUpgrade gtkUpgrade mysql-MaxUpgrade libwnck-64bitUpgrade kdelibs3-32bitUpgrade fontconfig-64bitUpgrade qt3-examplesUpgrade qt3Upgrade qt3-unixODBC | Feb 17, 2015 | Jun 15, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub