Authorization Bypass

hplip is vulnerable to authorization bypass. The checkpermissionv1 function in base/pkit.py does not properly use D-Bus for communications with a polkit authority. A race condition in the PolkitUnixProcess PolkitSubject allows a local user to bypass access restrictions via a setuid or pkexec...

Race condition

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, related to...

CVE-2014-5033

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, related to...

CVE-2014-5033: Concurrent Execution using Shared Resource with Improper Synchronization

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, related to...

CVE-2014-5033

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, related to...

PT-2014-1805

Name of the Vulnerable Software and Affected Versions polkit-qt versions 0.103.0 kdelibs versions prior to 4.14 kauth versions prior to 5.1 Description The issue allows local users to bypass intended access restrictions, potentially leading to a violation of confidentiality, integrity, and...

CVE-2013-1063

usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...

CVE-2013-1066

language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...

CVE-2013-1061

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProce...

CVE-2013-4326

RealtimeKit aka rtkit 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to...

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

CVE-2013-1063

CVE-2013-1063 affects usb-creator versions before 0.2.47.1 and earlier Ubuntu builds (0.2.40ubuntu2, 0.2.38.2). The flaw arises from improper D-Bus communication with a Polkit authority, enabling local users to bypass access restrictions via a PolkitUnixProcess PolkitSubject race conditioned by a...

CVE-2013-1064

CVE-2013-1064 concerns apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1, which allegedly bypasses access restrictions by exploiting a PolkitUnixProcess PolkitSubject race via a (1) setuid process or (2) pkexec process. Connected Nessus entries reference CVE-2013-4288 (PolKi...

CVE-2013-1064

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

CVE-2013-4311

libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

PT-2013-2851

Name of the Vulnerable Software and Affected Versions usb-creator versions 0.2.38 through 0.2.38.1 usb-creator versions 0.2.40 through 0.2.40ubuntu1 usb-creator version 0.2.47 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess...

PT-2013-2852

Name of the Vulnerable Software and Affected Versions apt-xapian-index versions prior to 0.45ubuntu2.1 apt-xapian-index version 0.44ubuntu7.1 apt-xapian-index version 0.44ubuntu5.1 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess...

PT-2013-1263

Name of the Vulnerable Software and Affected Versions systemd affected versions not specified hplip versions prior to 3.14.1 Description The issue involves a race condition in PolkitUnixProcess PolkitSubject, allowing local users to bypass access restrictions. This can be achieved through a setui...

PT-2013-2854

Name of the Vulnerable Software and Affected Versions language-selector versions 0.79.x through 0.79.3 language-selector versions 0.90.x through 0.90.0 language-selector versions 0.110.x through 0.110.0 Description The issue allows local users to bypass intended access restrictions by leveraging ...

CVE-2013-1061: Undefined Security Weakness

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProce...