CVE-2012-1093: 
Linux Debian vulnerability analysis and mitigation

CVE-2012-1093 is a security vulnerability discovered in the Debian x11-common package before version 1:7.6+12. The vulnerability was identified as a symlink attack that could lead to privilege escalation during package installation (NVD). This is specifically a Debian and Ubuntu-specific issue, as confirmed by the original reporter (OSS Security).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), indicating a link following issue. The attack requires local access, low attack complexity, and low privileges, but can result in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability allows a local user to gain root privileges when the x11-common service is started. This privilege escalation can occur during package installation, potentially compromising system security (OSS Security).

The vulnerability was fixed in Debian x11-common package version 1:7.6+12. Multiple Debian releases including bullseye, bookworm, sid, and trixie have received fixes with versions 1:7.7+22, 1:7.7+23, and 1:7.7+24 respectively (Debian Security).