Description
X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libx11 | 2:1.0.0-7 | — |
| Debian 14 | xdm | 1:1.0.5-1 | — |
| Debian 14 | xorg-server | 1:1.0.2-9 | — |
| Debian 14 | xterm | No fix yet | — |
| Debian 14 | xtrans | 1.0.0-6 | — |
| Debian 13 | libx11 | 2:1.0.0-7 | — |
| Debian 13 | xdm | 1:1.0.5-1 | — |
| Debian 13 | xorg-server | 1:1.0.2-9 | — |
| Debian 13 | xterm | No fix yet | — |
| Debian 13 | xtrans | 1.0.0-6 | — |
| Debian 12 | libx11 | 2:1.0.0-7 | — |
| Debian 12 | xdm | 1:1.0.5-1 | — |
| Debian 12 | xorg-server | 1:1.0.2-9 | — |
| Debian 12 | xterm | No fix yet | — |
| Debian 12 | xtrans | 1.0.0-6 | — |
| Debian 3.1 | xfree86 | 4.3.0.dfsg.1-14sarge2 | DSA-1193-1 |
Advisories 1
- DSA-1193-1 xfree86 Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21660 third-party-advisory
- MDKSA-2006:160 vendor-advisory
- [xorg] 20060620 X.Org security advisory: setuid return value check problems mailing-list
- VU#300368 third-party-advisory
- ADV-2006-3409 vdb-entry
- 21693 third-party-advisory
- DSA-1193 vendor-advisory
- GLSA-200704-22 vendor-advisory
- 22332 third-party-advisory
- ADV-2007-0409 vdb-entry
- GLSA-200608-25 vendor-advisory
- 23697 vdb-entry
- 25059 third-party-advisory
- 25032 third-party-advisory
- [beast] 20061228 ANNOUNCE: BEAST/BSE v0.7.1 mailing-list
- 19742 vdb-entry
- 21650 third-party-advisory