CVE-2006-1183 json
The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world…
published 2006-03-13 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1187
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 1
- Exploit-DB
Summary
The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.
Timeline
- First public exploit (EDB-1579)
- Published
Exploit prediction
3.30% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-1579 Ubuntu 5.10 Installer - Password Disclosure local, 2006-03-12
- launchpad.net https://launchpad.net/distros/ubuntu/+source/shadow/+bug/34606 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
launchpad.net
/distros/ubuntu/+source/shadow/+bug/34606
exploit
-
usn.ubuntu.com
/262-1/
vendor-advisory
-
securityfocus.com
/bid/17086
vdb-entry
-
osvdb.org
/23868
vdb-entry
-
vupen.com
/english/advisories/2006/0927
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/25170
vdb-entry
-
securitytracker.com
/id?1015761
vdb-entry
-
secunia.com
/advisories/19200
third-party-advisory
Sources
- CVE List CVE-2006-1183
- NVD CVE-2006-1183
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.