← Vulnerability feed

Vulnerability record · CVE-2006-0745 · published 21 March 2006

CVE-2006-0745: X.org x11r6 vulnerability

XX.Org · X11r6

X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.

7.2 CVSS 2.0 High EPSS 1.1% · top 34.9%
7.2CVSS 2.0 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
6Affected product versions listed by NVD
42References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

X.Org server (xorg-server) 1.0.0 and later, X11R6.9.0, and X11R7.0 inadvertently treats the address of the geteuid function as if it is the return value of a call to geteuid, which allows local users to bypass intended restrictions and (1) execute arbitrary code via the -modulepath command line option or (2) overwrite arbitrary files via -logfile.

AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/19256
http://secunia.com/advisories/19307
http://secunia.com/advisories/19311
http://secunia.com/advisories/19316
http://secunia.com/advisories/19676
http://securityreason.com/securityalert/606
http://securitytracker.com/id?1015793
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102252-1
http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm
http://www.mandriva.com/security/advisories?name=MDKSA-2006:056
http://www.novell.com/linux/security/advisories/2006_16_xorgx11server.html
http://www.osvdb.org/24000
http://www.osvdb.org/24001
http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00026.html
http://www.securityfocus.com/archive/1/428183/100/0/threaded
http://www.securityfocus.com/archive/1/428230/100/0/threaded
http://www.securityfocus.com/bid/17169 ExploitPatch
http://www.vupen.com/english/advisories/2006/1017
http://www.vupen.com/english/advisories/2006/1028
https://exchange.xforce.ibmcloud.com/vulnerabilities/25341
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1697
http://secunia.com/advisories/19256
http://secunia.com/advisories/19307
http://secunia.com/advisories/19311
http://secunia.com/advisories/19316
http://secunia.com/advisories/19676
http://securityreason.com/securityalert/606
http://securitytracker.com/id?1015793
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102252-1
http://support.avaya.com/elmodocs2/security/ASA-2006-078.htm
http://www.mandriva.com/security/advisories?name=MDKSA-2006:056
http://www.novell.com/linux/security/advisories/2006_16_xorgx11server.html
http://www.osvdb.org/24000
http://www.osvdb.org/24001
http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00026.html
http://www.securityfocus.com/archive/1/428183/100/0/threaded
http://www.securityfocus.com/archive/1/428230/100/0/threaded
http://www.securityfocus.com/bid/17169 ExploitPatch
http://www.vupen.com/english/advisories/2006/1017
http://www.vupen.com/english/advisories/2006/1028

Track CVE-2006-0745 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2009-2296Sun opensolaris vulnerabilityThe NFSv4 server kernel module in Sun Solaris 10, and OpenSolaris before snv_119, does not properly implement the nfs_portmon setting, which allows r…EPSS 4.4%10.0CVE-2008-3869Sun solaris memory buffer overflow vulnerabilityHeap-based buffer overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request, related to …EPSS 7.6%10.0CVE-2008-3870Sun solaris vulnerabilityInteger overflow in sadmind in Sun Solaris 8 and 9 allows remote attackers to execute arbitrary code via a crafted RPC request that triggers a heap-b…EPSS 7.8%10.0CVE-2008-5010Sun opensolaris vulnerabilityin.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers to cause a denial of service…EPSS 4.8%10.0CVE-2008-4556Sun Solaris sadmind adm_build_path stack buffer overflowThe adm_build_path function in sadmind, part of Sun Solstice AdminSuite on Solaris 8 and 9, contains a stack-based buffer overflow (CWE-119) reachabl…EPSS 70%analysed10.0CVE-2007-4074Centre for speech technology research gentoo linux vulnerabilityThe default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly…EPSS 5.4%10.0CVE-2007-3093Sun solaris vulnerabilityUnspecified vulnerability in the logging mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote atta…EPSS 4.7%10.0CVE-2007-0460Suse linux memory buffer overflow vulnerabilityMultiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2006-0745), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.