CVE-2006-4842

nspr: setuid root programs linked with NSPR allow elevation of privilege

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · September 5, 2006

Updated · November 21, 2025

Description

The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment variables for specifying log files even when running from setuid programs, which allows local users to create or overwrite arbitrary files.

Statement

This issue also affects other OS that use NSPR. However, Red Hat does not ship any application linked setuid or setgid against NSPR and therefore is not vulnerable to this issue.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-270 · Privilege Context Switching Error