CVE-2012-1093: 
Linux Debian vulnerability analysis and mitigation

CVE-2012-1093 is a security vulnerability discovered in the Debian x11-common package before version 1:7.6+12. The vulnerability was identified as a symlink attack that could lead to privilege escalation during package installation (NVD). This is specifically a Debian and Ubuntu-specific issue, as confirmed by the original reporter (OSS Security).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), indicating a link following issue. The attack requires local access, low attack complexity, and low privileges, but can result in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability allows a local user to gain root privileges when the x11-common service is started. This privilege escalation can occur during package installation, potentially compromising system security (OSS Security).

The vulnerability requires local access to the system and can be exploited during the package installation process. Exploit code has been documented and the vulnerability has been confirmed to be exploitable (NVD).

The vulnerability was fixed in Debian x11-common package version 1:7.6+12. Multiple Debian releases including bullseye, bookworm, sid, and trixie have received fixes with versions 1:7.7+22, 1:7.7+23, and 1:7.7+24 respectively (Debian Security).