QwikSec

Security Database

CVE

CWE

Training

CVE-2013-4324

Published: Oct 3, 2013

Modified: Aug 6, 2024

PUBLISHED

Description

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

openSUSE-SU-2013:1562

vendor-advisory

x_refsource_SUSE

third-party-advisory

x_refsource_SECUNIA

[oss-security] 20130918 Re: Fwd: [vs-plain] polkit races

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_REDHAT

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.