CVE-2006-5397 Information disclosure in n/a
Local attackers can read arbitrary files via a file descriptor leak in the Xinput module of libX11.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-5397?
CVE-2006-5397 is a low-severity vulnerability in n/a, published on 3 Nov 2006. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Xinput module (modules/im/ximcp/imLcIm.c) in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor.
Which versions are affected by CVE-2006-5397?
It affects 1 product.
Products include X.org Libx11.
How do I fix CVE-2006-5397?
Upgrade to a fixed version.
Is CVE-2006-5397 being exploited?
There is no known exploitation of CVE-2006-5397 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2006-5397, GHSA-mfr2-w78g-62fw.