Stunnel 4
Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server.
Exploitability
AV:L
AC:L
Au:N
Impact
C:P
I:P
A:P
4.6/AV:L/AC:L/Au:N/C:P/I:P/A:P