1637 matches found
Authorization Bypass
hplip is vulnerable to authorization bypass. The checkpermissionv1 function in base/pkit.py does not properly use D-Bus for communications with a polkit authority. A race condition in the PolkitUnixProcess PolkitSubject allows a local user to bypass access restrictions via a setuid or pkexec...
Privilege Escalation
polkit is vulnerable to privilege escalation. A race condition in the PolicyKit pkcheck utility when the process is specified by its process ID via the --process option, allows a local user to bypass intended authorization and escalate their privileges by starting a setuid or pkexec process befor...
Fedora 29 : polkit (2019-e957cecffd)
Due to kernel issue there is a way to reuse starttime of a process. This allows to duplicate process authorized by polkit. This update mitigates polkit issue 75 slowfork: https://gitlab.freedesktop.org/polkit/polkit/issues/75 Note that Tenable Network Security has extracted the preceding...
[SECURITY] Fedora 29 Update: polkit-0.115-4.2.fc29
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes...
ALPINE-CVE-2019-6133
In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...
CVE-2019-6133
CVE-2019-6133 affects PolicyKit (polkit). A local attacker could bypass authentication by exploiting a race during fork() where authorization decisions were cached and not atomically tied to the correct process, due to missing UID checks in polkitbackendinteractiveauthority.c. The issue has been ...
CVE-2019-6133
In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...
CVE-2019-6133
In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...
openSUSE: Security Advisory for polkit (openSUSE-SU-2019:0010-1)
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
openSUSE Security Update : polkit (openSUSE-2019-10)
This update for polkit fixes the following issues : Security issue fixed : - CVE-2018-19788: Fixed handling of UIDs over MAXUINT bsc1118277 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...
UBUNTU-CVE-2019-6133
In PolicyKit aka polkit 0.115, the "start time" protection mechanism can be bypassed because fork is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c...
Security update for polkit (moderate)
openSUSE Security Update: Security update for polkit Announcement ID: openSUSE-SU-2019:0010-1 Rating: moderate References: 1118277 Cross-References: CVE-2018-19788 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for polkit...
polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork
polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork / When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt bein...
polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork
/ When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt being shown to the user, asking the user to confirm the action by enteri...
Security fix for the ALT Linux 9 package polkit version 0.115-alt5
Jan. 9, 2019 Yuri N. Sedunov 0.115-alt5 - updated to 0.115-26-gc898fdf fixed CVE-2018-19788...
polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork Exploit
/ When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt being shown to the user, asking the user to confirm the action by enteri...
[ASA-201901-2] polkit: privilege escalation
Arch Linux Security Advisory ASA-201901-2 ========================================= Severity: High Date : 2019-01-08 CVE-ID : CVE-2018-19788 Package : polkit Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-828 Summary ======= The package polkit before version...
SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2019:0019-1)
This update for polkit fixes the following issues : Security issue fixed : CVE-2018-19788: Fixed handling of UIDs over MAXUINT bsc1118277 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatical...
SUSE SLED15 / SLES15 Security Update : polkit (SUSE-SU-2019:0015-1)
This update for polkit fixes the following issues : Security issue fixed : CVE-2018-19788: Fixed handling of UIDs over MAXUINT bsc1118277 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatical...