3881 matches found
Race condition
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...
Race condition
Race condition in PolicyKit aka polkit allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to 1 the polkitunixprocessnew API function, 2 the dbus API, or 3 the --process...
Race condition
spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkitunixprocessnew API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process...
CVE-2013-1066
The CVE-2013-1066 entry affects language-selector in multiple Ubuntu-derived streams (0.110.x before 0.110.1, 0.90.x before 0.90.1, 0.79.x before 0.79.4). The root cause is improper use of D-Bus for communication with Polkit, enabling a PolkitUnixProcess PolkitSubject race condition that local us...
CVE-2013-4311
CVE-2013-4311 stems from a PolkitUnixProcess race in pkcheck that can bypass access controls via a (setuid) process or pkexec, enabling local privilege bypass. Affected are libvirt components across multiple branches: libvirt 1.0.5.x (before 1.0.5.6), 0.10.2.x (before 0.10.2.8), and 0.9.12.x (bef...
CVE-2013-4327
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...
CVE-2013-4327
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...
CVE-2013-4288
Polkit (PolicyKit) contains a race condition that can allow a local user to bypass authorization by starting a setuid or pkexec process before the polkit authorization check completes. The issue centers on the PolkitUnixProcess race (including polkit_unix_process_new API usage) and is related to ...
CVE-2013-1061: Undefined Security Weakness
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProce...
PT-2013-2851
Name of the Vulnerable Software and Affected Versions usb-creator versions 0.2.38 through 0.2.38.1 usb-creator versions 0.2.40 through 0.2.40ubuntu1 usb-creator version 0.2.47 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess...
PT-2013-2853
Name of the Vulnerable Software and Affected Versions Jockey versions prior to 0.9.7-0ubuntu7.11 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process. This is related t...
CVE-2013-1062: Undefined Security Weakness
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...
PT-2013-2854
Name of the Vulnerable Software and Affected Versions language-selector versions 0.79.x through 0.79.3 language-selector versions 0.90.x through 0.90.0 language-selector versions 0.110.x through 0.110.0 Description The issue allows local users to bypass intended access restrictions by leveraging ...
PT-2013-2850
Name of the Vulnerable Software and Affected Versions ubuntu-system-service versions 0.2.2 through 0.2.2.1 ubuntu-system-service versions 0.2.3 through 0.2.3.1 ubuntu-system-service versions 0.2.4 through 0.2.4.1, but not including 0.2.4.1 and later Description The issue allows local users to...
CVE-2013-1063: Undefined Security Weakness
usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...
PT-2013-2852
Name of the Vulnerable Software and Affected Versions apt-xapian-index versions prior to 0.45ubuntu2.1 apt-xapian-index version 0.44ubuntu7.1 apt-xapian-index version 0.44ubuntu5.1 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess...
rtkit: insecure calling of polkit
RealtimeKit aka rtkit 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to...
Race condition
The checkpermissionv1 function in base/pkit.py in HP Linux Imaging and Printing HPLIP through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race conditio...
CVE-2013-1062
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...
