CVE-2000-1060: XFREE86 Project Xfce

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program, which allows local users to sniff X Windows traffic and gain privileges.

Affected products

Published 2000-12-11. Last modified 2026-06-16.