CVE-2006-0646

CVE-2006-0646 is a medium-severity vulnerability in Suse Suse Linux with a CVSS 2.0 base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.

Frequently asked questions

What is CVE-2006-0646?
ld in SUSE Linux 9.1 through 10.0, and SLES 9, in certain circumstances when linking binaries, can leave an empty RPATH or RUNPATH, which allows local attackers to execute arbitrary code as other users via by running an ld-linked application from the current directory, which could contain an attacker-controlled library file.
How severe is CVE-2006-0646?
CVE-2006-0646 has a CVSS 2.0 base score of 4.4, rated medium severity.
Is CVE-2006-0646 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-0646?
CVE-2006-0646 primarily affects Suse Suse Linux. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2006-0646?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-0646 published?
CVE-2006-0646 was published on 2006-02-11 and last updated on 2026-06-16.

References

Affected products (11)

More vulnerabilities in Suse Suse Linux

All CVEs affecting Suse Suse Linux →