Root privilege escalation via symlinked socket directories

Local privilege escalation in Debian x11-common before 1:7.6+12 allows local users to gain root privileges during package installation. The x11-common init script runs mkdir -p, chown, and chmod on /tmp/.X11-unix and /tmp/.ICE-unix without rejecting symlinks, so those operations follow an attacker-selected directory. A local user must create the symlink before the privileged service starts; the resulting ownership and mode changes can make a root-owned directory attacker-writable.