CVE-2007-0166: Freebsd

Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are mounted or unmounted, which allows local root users to overwrite arbitrary files, or mount/unmount files, outside of the jail via a symlink attack.

Affected products

• Freebsd Freebsd: up to and including 6.2; version 5.3 only

Published 2007-01-11. Last modified 2026-06-16.