CVE-2006-0071

MediumCVSS 6.6/10Last modified Jun 16, 2026

Description

The ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0.

Metrics

CVSS 2.0 6.6/10AV:L/AC:L/Au:N/C:C/I:C/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/18284
http://www.gentoo.org/security/en/glsa/glsa-200601-01.xmlPatch, Vendor Advisory
http://www.osvdb.org/22211
http://www.securityfocus.com/bid/16120Patch
http://secunia.com/advisories/18284
http://www.gentoo.org/security/en/glsa/glsa-200601-01.xmlPatch, Vendor Advisory
http://www.osvdb.org/22211
http://www.securityfocus.com/bid/16120Patch

Timeline

Published: Jan 4, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-00727.5Buffer overflow in termsh on SCO OpenServer 5.0.7 allows remote attackers to execute arbitrary code via a long -o command line argument. NO CVE-2006-00734.3Cross-site scripting (XSS) vulnerability in DiscusWare Discus Freeware 3.10.5 and Professional 3.10.4 allows remote attackers to inject arbi CVE-2006-00747.5SQL injection vulnerability in profile.php in PHPenpals allows remote attackers to execute arbitrary SQL commands via the personalID paramet CVE-2006-00757.5Direct static code injection vulnerability in phpBook 1.3.2 and earlier allows remote attackers to execute arbitrary PHP code via the e-mail CVE-2006-00767.5PHP remote file include vulnerability in forum.php in oaBoard 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc CVE-2006-00772.1Off-by-one error in the getfattr function in File::ExtAttr before 0.03 allows attackers to trigger a buffer overflow via unspecified attack CVE-2006-00784.3Multiple cross-site scripting (XSS) vulnerabilities in B-net Software 1.0 allow remote attackers to inject arbitrary web script or HTML via CVE-2006-00797.5SQL injection vulnerability in auth.php in ScozNet ScozBook BETA 1.1 allows remote attackers to execute arbitrary SQL commands via the usern CVE-2006-00804.3Cross-site scripting (XSS) vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web CVE-2006-00817.8ialmnt5.sys in the ialmrnt5 display driver in Intel Graphics Accelerator Driver 6.14.10.4308 allows attackers to cause a denial of service (CVE-2006-00825.1Format string vulnerability in the SetImageInfo function in image.c for ImageMagick 6.2.3 and other versions, and GraphicsMagick, allows use CVE-2006-00834.6Format string vulnerability in the logging code of SMS Server Tools (smstools) 1.14.8 and earlier allows local users to execute arbitrary co