CVE-2006-5461

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-11-14 · updated 2026-06-16

Description

Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi.

Affected products

avahi: through 0.6.14

References

http://avahi.org/milestone/Avahi%200.6.15
http://secunia.com/advisories/22807
http://secunia.com/advisories/22852
http://secunia.com/advisories/22932
http://secunia.com/advisories/23020
http://secunia.com/advisories/23042
http://securitytracker.com/id?1017257
http://www.gentoo.org/security/en/glsa/glsa-200611-13.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2006:215
http://www.novell.com/linux/security/advisories/2006_26_sr.html
http://www.securityfocus.com/bid/21016
http://www.vupen.com/english/advisories/2006/4474

Get alerted when CVE-2006-5461 or the next vulnerability affects your stack