https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit

https://git.enlightenment.org/enlightenment/enlightenment/commit/cae78cbb169f237862faef123e4abaf63a1f5064

https://git.enlightenment.org/enlightenment/enlightenment/commit/cc7faeccf77fef8b0ae70e312a21e4cde087e141

The remote Fedora 36 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-0cc77b384a advisory.

  - elevate privileges to root. [fedora-all] (CVE-2022-37706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-bafb72fdc0 advisory.

  - elevate privileges to root. [fedora-all] (CVE-2022-37706)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10153-1 advisory.

  - enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is     setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
    (CVE-2022-37706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5233 advisory.

  - enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is     setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
    (CVE-2022-37706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3115 advisory.

  - enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is     setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.
    (CVE-2022-37706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
169272	Fedora 36 : efl / enlightenment (2022-0cc77b384a)	Nessus	Fedora Local Security Checks	high
169176	Fedora 35 : efl / enlightenment (2022-bafb72fdc0)	Nessus	Fedora Local Security Checks	high
166308	openSUSE 15 Security Update : enlightenment (openSUSE-SU-2022:10153-1)	Nessus	SuSE Local Security Checks	high
165331	Debian DSA-5233-1 : e17 - security update	Nessus	Debian Local Security Checks	high
165256	Debian DLA-3115-1 : e17 - LTS security update	Nessus	Debian Local Security Checks	high

CVE-2022-37706

high

Tenable Plugins

high

high

high

high

high