CVE-2006-2449

Description

KDE Display Manager (KDM) in KDE 3.2.0 up to 3.5.3 allows local users to read arbitrary files via a symlink attack related to the session type for login.

4.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.08%

Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory debian.org Vendor Advisory novell.com Vendor Advisory gentoo.org Vendor Advisory slackware.com Vendor Advisory mandriva.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory kde.org

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/21662	third party advisory vendor advisory
http://secunia.com/advisories/20890	third party advisory vendor advisory
http://secunia.com/advisories/20674	third party advisory vendor advisory
http://www.osvdb.org/26511	vdb entry
http://secunia.com/advisories/20702	third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2006-0548.html	patch vendor advisory
http://securitytracker.com/id?1016297	vdb entry
http://www.mandriva.com/security/advisories?name=MDKSA-2006:106	vendor advisory
https://usn.ubuntu.com/301-1/	vendor advisory
http://secunia.com/advisories/20602	third party advisory vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27181	vdb entry
http://secunia.com/advisories/20869	third party advisory vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9844	vdb entry signature
http://www.vupen.com/english/advisories/2006/2355	vdb entry
http://secunia.com/advisories/20660	third party advisory vendor advisory
http://www.debian.org/security/2006/dsa-1156	vendor advisory
http://www.securityfocus.com/archive/1/437133/100/0/threaded	mailing list
http://www.novell.com/linux/security/advisories/2006_39_kdm.html	vendor advisory
http://www.kde.org/info/security/advisory-20060614-1.txt	vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200606-23.xml	vendor advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.444467	vendor advisory
http://secunia.com/advisories/20785	third party advisory vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:105	vendor advisory
http://www.securityfocus.com/archive/1/437322/100/0/threaded	mailing list
http://www.securityfocus.com/bid/18431	vdb entry

Frequently Asked Questions

What is the severity of CVE-2006-2449?: CVE-2006-2449 has been scored as a medium severity vulnerability.
How to fix CVE-2006-2449?: To fix CVE-2006-2449, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-2449 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2006-2449 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.