Scientific Linux Security Update : polkit on SL6.x i386/x86_64 (20130919)

A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit authorizations and escalate their privileges. CVE-2013-4288...

CentOS 6 : polkit (CESA-2013:1270)

Updated polkit packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Oracle Linux 6 : polkit (ELSA-2013-1270)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1270 advisory. - Include fix for CVE-2013-4288 - Include fixes for CVE-2011-1485 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 6 : hplip (ELSA-2013-1274)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1274 advisory. 3.12.4-4:.1 - Applied patch to avoid unix-process authorization subject when using polkit as it is racy CVE-2013-4325. Tenable has extracted the preceding...

Fedora 19 : hplip-3.13.9-2.fc19 (2013-17127)

This update brings in the latest upstream release and fixes a security issue with the way polkit is used for authentication. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean an...

libvirt: insecure calling of polkit

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

hplip: Insecure calling of polkit

The checkpermissionv1 function in base/pkit.py in HP Linux Imaging and Printing HPLIP through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race conditio...

spice-gtk: Insecure calling of polkit via polkit_unix_process_new()

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkitunixprocessnew API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process...

polkit: unix-process subject for authorization is racy

Race condition in PolicyKit aka polkit allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to 1 the polkitunixprocessnew API function, 2 the dbus API, or 3 the --process...

Ubuntu 12.04 LTS / 12.10 / 13.04 : ubuntu-system-service vulnerability (USN-1962-1)

It was discovered that ubuntu-system-service was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

Ubuntu 12.04 LTS / 12.10 / 13.04 : rtkit vulnerability (USN-1959-1)

It was discovered that RealtimeKit was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable ha...

Ubuntu 12.04 LTS / 12.10 / 13.04 : language-selector vulnerability (USN-1958-1)

It was discovered that language-selector was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

libvirt security and bug fix update

0.10.2-18.0.1.el64.14 - Replace docs/et.png in tarball with blank image 0.10.2-18.el64.14 - spec: Update requirements to pick up rebuilt polkit CVE-2013-4311 0.10.2-18.el64.13 - spec: Fix messed up dependency on polkit CVE-2013-4311 0.10.2-18.el64.12 - Introduce APIs for splitting/joining strings...

hplip security update

3.12.4-4:.1 - Applied patch to avoid unix-process authorization subject when using polkit as it is racy CVE-2013-4325...

Ubuntu 13.04 : systemd vulnerability (USN-1961-1)

It was discovered that systemd was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : hplip vulnerability (USN-1956-1)

It was discovered that HPLIP was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has...

Ubuntu 12.04 LTS : jockey vulnerability (USN-1957-1)

It was discovered that Jockey was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has...

Ubuntu 12.04 LTS / 12.10 / 13.04 : apt-xapian-index vulnerability (USN-1955-1)

It was discovered that apt-xapian-index was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenab...

Ubuntu 12.04 LTS / 12.10 / 13.04 : usb-creator vulnerability (USN-1963-1)

It was discovered that usb-creator was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable ha...

polkit security update

0.96-5 - Actually apply the patch, and modify it to apply to 0.96 - Resolves: 1006262 0.96-4.el64 - Include fix for CVE-2013-4288 - Resolves: 1006262 0.96-3.el64 - Include fixes for CVE-2011-1485 - Resolves: 692942...