[SA13981] uim Environment Variable Trust Privilege Escalation

TITLE: uim Environment Variable Trust Privilege Escalation SECUNIA ADVISORY ID: SA13981 VERIFY ADVISORY: http://secunia.com/advisories/13981/ CRITICAL: Less critical IMPACT: Privilege escalation WHERE: Local system SOFTWARE: uim 0.x http://secunia.com/product/4680/ DESCRIPTION: Takumi Asaki has...

CVE-2005-0503

The CVE-2005-0503 issue affects uim (libuim) where environment variables are trusted when linked into setuid/setgid applications, enabling local privilege escalation. Public details from Gentoo GLSA 200502-31 and SUSE/Gentoo advisories specify that only immodule-enabled Qt builds are affected (Qt...

CVE-2005-0503

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges...

CVE-2005-0503

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges...

CVE-2005-0503

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges...

CVE-2005-0503

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges...

CVE-2005-0503

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges...

DEBIAN-CVE-2005-0503

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges...

uim -- privilege escalation vulnerability

The uim developers reports: Takumi ASAKI discovered that uim always trusts environment variables. But this is not correct behavior, sometimes environment variables shouldn't be trusted. This bug causes privilege escalation when libuim is linked against setuid/setgid application. Since GTK+...