CVE-2013-4288

Race condition in PolicyKit aka polkit allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to 1 the polkitunixprocessnew API function, 2 the dbus API, or 3 the --process...

CVE-2013-1064

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

CVE-2013-1065

backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related...

CVE-2013-1064

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

Race condition

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

Race condition

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkitunixprocessnew API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process...

Race condition

Race condition in PolicyKit aka polkit allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to 1 the polkitunixprocessnew API function, 2 the dbus API, or 3 the --process...

CVE-2013-4324

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkitunixprocessnew API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process...

CVE-2013-1066

The CVE-2013-1066 entry affects language-selector in multiple Ubuntu-derived streams (0.110.x before 0.110.1, 0.90.x before 0.90.1, 0.79.x before 0.79.4). The root cause is improper use of D-Bus for communication with Polkit, enabling a PolkitUnixProcess PolkitSubject race condition that local us...

CVE-2013-4288

Polkit (PolicyKit) contains a race condition that can allow a local user to bypass authorization by starting a setuid or pkexec process before the polkit authorization check completes. The issue centers on the PolkitUnixProcess race (including polkit_unix_process_new API usage) and is related to ...

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

CVE-2013-4311

CVE-2013-4311 stems from a PolkitUnixProcess race in pkcheck that can bypass access controls via a (setuid) process or pkexec, enabling local privilege bypass. Affected are libvirt components across multiple branches: libvirt 1.0.5.x (before 1.0.5.6), 0.10.2.x (before 0.10.2.8), and 0.9.12.x (bef...

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

PT-2013-2850

Name of the Vulnerable Software and Affected Versions ubuntu-system-service versions 0.2.2 through 0.2.2.1 ubuntu-system-service versions 0.2.3 through 0.2.3.1 ubuntu-system-service versions 0.2.4 through 0.2.4.1, but not including 0.2.4.1 and later Description The issue allows local users to...

PT-2013-2853

Name of the Vulnerable Software and Affected Versions Jockey versions prior to 0.9.7-0ubuntu7.11 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process. This is related t...

PT-2013-2851

Name of the Vulnerable Software and Affected Versions usb-creator versions 0.2.38 through 0.2.38.1 usb-creator versions 0.2.40 through 0.2.40ubuntu1 usb-creator version 0.2.47 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess...

PT-2013-2854

Name of the Vulnerable Software and Affected Versions language-selector versions 0.79.x through 0.79.3 language-selector versions 0.90.x through 0.90.0 language-selector versions 0.110.x through 0.110.0 Description The issue allows local users to bypass intended access restrictions by leveraging ...

PT-2013-2852

Name of the Vulnerable Software and Affected Versions apt-xapian-index versions prior to 0.45ubuntu2.1 apt-xapian-index version 0.44ubuntu7.1 apt-xapian-index version 0.44ubuntu5.1 Description The issue allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess...

CVE-2013-1061: Undefined Security Weakness

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProce...

CVE-2013-1062: Undefined Security Weakness

ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1...