CVE-2006-5215: Netbsd

Low severity, CVSS 2.6. EPSS: 0.3% chance of exploitation in the next 30 days.

The Xsession script, as used by X Display Manager (xdm) in NetBSD before 20060212, X.Org before 20060317, and Solaris 8 through 10 before 20061006, allows local users to overwrite arbitrary files, or read another user's Xsession errors file, via a symlink attack on a /tmp/xses-$USER file.

Affected products

• Netbsd Netbsd: up to and including current; version 1.0 only; version 1.1 only; version 1.2 only; version 1.2.1 only; version 1.3 only; …
• Sun Solaris: version 8.0 only; version 9.0 only; version 10.0 only
• Sun Sunos: version 5.8 only; version 5.9 only
• X.org Xdm: up to and including 1.0.3

Published 2006-10-10. Last modified 2026-06-16.