high7.8Public exploit code
CVE-2022-37706
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pa…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Enlightenment v0.25.3 - Privilege escalation2023-04-01 · local · linux
Impact
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Enlightenment | Enlightenment | before 0.25.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141
- https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064
- https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141
- https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit