UBUNTU-CVE-2022-37706: High severity ubuntu/e17 vulnerability
enlightenmentsys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low-level privileges on the affected system. No user interaction is required.
What is the potential impact of successful exploitation?
Successful exploitation can allow a local user to gain elevated privileges. The provided severity vector indicates high impact to confidentiality, integrity, and availability.
How can I determine whether a system is affected?
Check whether the system runs Enlightenment earlier than 0.25.4 and whether the enlightenment_sys component is setuid root. The affected software entry is ubuntu/e17.
What version resolves the issue?
The issue affects Enlightenment versions before 0.25.4. Updating to version 0.25.4 or later removes the affected version range.