Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-f8f8-m8xj-9xh7

Опубликовано: 14 июл. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 6.7

Описание

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

EPSS

Процентиль: 2%
0.00016
Низкий

6.7 Medium

CVSS3

Дефекты

CWE-787

Связанные уязвимости

CVSS3: 6.7
ubuntu
23 дня назад

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

CVSS3: 6.7
redhat
27 дней назад

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

CVSS3: 6.7
nvd
23 дня назад

A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.

CVSS3: 6.7
debian
23 дня назад

A flaw was found in polkit. When processing an XML policy with 32 or m ...

suse-cvrf
12 дней назад

Security update for polkit

EPSS

Процентиль: 2%
0.00016
Низкий

6.7 Medium

CVSS3

Дефекты

CWE-787