CVE-2017-7572

The checkPolkitPrivilege function in serviceHelper.py in Back In Time aka backintime 1.1.18 and earlier uses a deprecated polkit authorization method unix-process that is subject to a race condition time of check, time of use. With this authorization method, the owner of a process requesting a...

AZL-6800 CVE-2016-2568 affecting package polkit 0.119-4

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

AZL-35109 CVE-2016-2568 affecting package polkit for versions less than 123-1

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer...

polkit: Heap-corruption on duplicate IDs

Background polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes. Description A vulnerability was discovered in polkit’s polkitbackendactionpoolinit function due to duplicate action IDs in action descriptions. Impact Local attackers a...

GLSA-201611-07 : polkit: Heap-corruption on duplicate IDs

The remote host is affected by the vulnerability described in GLSA-201611-07 polkit: Heap-corruption on duplicate IDs A vulnerability was discovered in polkits polkitbackendactionpoolinit function due to duplicate action IDs in action descriptions. Impact : Local attackers are able to gain...

Oracle: Security Advisory (ELSA-2016-0189)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Scientific Linux Security Update : polkit on SL7.x x86_64 (20160216)

A denial of service flaw was found in how polkit handled authorization requests. A local, unprivileged user could send malicious requests to polkit, which could then cause the polkit daemon to corrupt its memory and crash. CVE-2015-3256 The system must be rebooted for this update to take effect...

Oracle Linux 7 : polkit (ELSA-2016-0189)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0189 advisory. 0.112-6 - Fix CVE-2015-3256 Resolves: 1271790 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

CentOS 7 : polkit (CESA-2016:0189)

Updated polkit packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from...

RedHat Update for polkit RHSA-2016:0189-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : polkit (RHSA-2016:0189)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0189 advisory. PolicyKit is a toolkit for defining and handling authorizations. A denial of service flaw was found in how polkit handled authorization requests. A...

CentOS Update for polkit CESA-2016:0189 centos7

Check the version of polkit SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882398";...

polkit: Memory corruption via javascript rule evaluation

A denial of service flaw was found in how polkit handled authorization requests. A local, unprivileged user could send malicious requests to polkit, which could then cause the polkit daemon to corrupt its memory and crash...

polkit security update

0.112-6 - Fix CVE-2015-3256 Resolves: 1271790...

SUSE SLED11 / SLES11 Security Update : kdebase4-workspace (SUSE-SU-2016:0303-1)

This update for kdebase4-workspace fixes the following issues : - CVE-2014-8651: Privilege escalation via KDE Clock KCM helper when non-default polkit settings are used bsc904625 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has...

FreeBSD : polkit -- multiple vulnerabilities (631fc042-b636-11e5-83ef-14dae9d210b8)

Colin Walters reports : - Integer overflow in the authenticationagentnewcookie function in PolicyKit aka polkit before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value. - The authenticationagentnew...

GLSA-201512-12 : KDE Systemsettings: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-201512-12 KDE Systemsettings: Privilege escalation KDE Systemsettings fails to properly validate user input before passing it as argument in context of higher privilege. Impact : A local attacker could gain privileges via a crafte...

KDE Systemsettings: Privilege escalation

Background KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. Description KDE Systemsettings fails to properly validate user input before passing it as argument in context of higher privilege. Impact A local attacker...

openSUSE Security Update : polkit (openSUSE-2015-711)

polkit was updated to the 0.113 release, fixing security issues and bugs. Security issues fixed : - Fixes CVE-2015-4625, a local privilege escalation due to predictable authentication session cookie values. Thanks to Tavis Ormandy, Google Project Zero for reporting this issue. For the future,...

SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2015:1838-1)

polkit was updated to the 0.113 release, fixing security issues and bugs. Security issues fixed : - Fixes CVE-2015-4625, a local privilege escalation due to predictable authentication session cookie values. Thanks to Tavis Ormandy, Google Project Zero for reporting this issue. For the future,...