2022-09-20
ALT-BU-2022-6228-1
Branch sisyphus_e2k update bulletin.
Package enlightenment updated to version 0.25.4-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Published: 2022-09-15
BDU:2022-06060
Уязвимость реализации системного файла Enlightenment_sys оконного менеджера Enlightenment, позволяющая нарушителю повысить свои привилегии
Severity: MEDIUM (6.8)
Vector: AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Severity: MEDIUM (4.6)
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
References:
Published: 2022-12-25
Modified: 2025-04-14
Modified: 2025-04-14
CVE-2022-37706
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141
- https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141
- https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit