CVE-2001-1409

LowCVSS 3.6/10Last modified Jun 16, 2026

Description

dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.

Metrics

CVSS 2.0 3.6/10AV:L/AC:L/Au:N/C:P/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://groups.google.com/groups?selm=20010829121505.A16004%40compusol.com.auPatch, Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-228529-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1017429.1-1
http://www.redhat.com/support/errata/RHSA-2003-067.htmlPatch, Vendor Advisory
http://groups.google.com/groups?selm=20010829121505.A16004%40compusol.com.auPatch, Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-228529-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1017429.1-1
http://www.redhat.com/support/errata/RHSA-2003-067.htmlPatch, Vendor Advisory

Timeline

Published: Jul 24, 2003
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-14105.0Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which c CVE-2001-14117.2Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.CVE-2001-14122.1nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command li CVE-2001-14137.5Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries CVE-2001-14147.5The Basic Security Module (BSM) for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide th CVE-2001-14154.6vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes.CVE-2001-14165.1Multiple cross-site scripting (XSS) vulnerabilities in the log messages in certain Alpha versions of AOL Instant Messenger (AIM) 4.4 allow r CVE-2001-14175.0AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application hang or crash) via a buddy icon GIF file w CVE-2001-14185.0AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a malformed WAV file.CVE-2001-14195.0AOL Instant Messenger (AIM) 4.7.2480 and earlier allows remote attackers to cause a denial of service (application crash) via an instant mes CVE-2001-14205.0AOL Instant Messenger (AIM) 4.7 allows remote attackers to cause a denial of service (application crash) via a long filename, possibly cause CVE-2001-14215.0AOL Instant Messenger (AIM) 4.7 and earlier allows remote attackers to cause a denial of service (application crash) via a large number of d