CVE-2000-1059

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

The default configuration of the Xsession file in Mandrake Linux 7.1 and 7.0 bypasses the Xauthority access control mechanism with an "xhost + localhost" command, which allows local users to sniff X Windows events and gain privileges.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2000
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2000

CVE-2000-10604.6The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc CVE-2000-10615.1Microsoft Virtual Machine (VM) in Internet Explorer 4.x and 5.x allows an unsigned applet to create and use ActiveX controls, which allows aCVE-2000-10625.0Buffer overflow in the FTP service in HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of seCVE-2000-10635.0Buffer overflow in the Telnet service in HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial ofCVE-2000-10645.0Buffer overflow in the LPD service in HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of seCVE-2000-10655.0Vulnerability in IP implementation of HP JetDirect printer card Firmware x.08.20 and earlier allows remote attackers to cause a denial of seCVE-2000-10665.0The getnameinfo function in FreeBSD 4.1.1 and earlier, and possibly other operating systems, allows a remote attacker to cause a denial of sCVE-2000-106810.0pollit.cgi in Poll It 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the poll_options parameter.CVE-2000-10696.4pollit.cgi in Poll It 2.01 and earlier allows remote attackers to access administrative functions without knowing the real password by speciCVE-2000-10705.0pollit.cgi in Poll It 2.01 and earlier uses data files that are located under the web document root, which allows remote attackers to accessCVE-2000-107110.0The GUI installation for iCal 2.1 Patch 2 disables access control for the X server using an "xhost +" command, which allows remote attackersCVE-2000-10727.2iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute
CVE-2000-1059: High severity, CVSS 7.2 | Vulnix