{
  "threat_severity" : "Moderate",
  "public_date" : "2024-01-21T00:00:00Z",
  "bugzilla" : {
    "description" : "arts: does not check the return value of the setuid  which prevents artsd from dropping privileges",
    "id" : "2259536",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2259536"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-273",
  "details" : [ "artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.", "A vulnerability was found in artswrapper in aRts. When running a setuid root, it does not check the return value of the setuid function call. This flaw allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges." ],
  "statement" : "Not vulnerable. We do not ship aRts as setuid root on Red Hat Enterprise Linux 2.1, 3, or 4.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "arts",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2006-2916\nhttps://nvd.nist.gov/vuln/detail/CVE-2006-2916\nhttps://mail.gnome.org/archives/beast/2006-December/msg00025.html" ],
  "name" : "CVE-2006-2916",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}