CVE-2013-1066

Опубликовано: 03 окт. 2013

Источник: nvd

CVSS2: 4.6

EPSS Низкий

Описание

language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Ссылки

http://secunia.com/advisories/54911
Vendor Advisory
http://www.ubuntu.com/usn/USN-1958-1
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/87379
https://launchpad.net/ubuntu/+source/language-selector/0.110.1
Patch
https://launchpad.net/ubuntu/+source/language-selector/0.79.4
Patch
https://launchpad.net/ubuntu/+source/language-selector/0.90.1
Patch
http://secunia.com/advisories/54911
Vendor Advisory
http://www.ubuntu.com/usn/USN-1958-1
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/87379
https://launchpad.net/ubuntu/+source/language-selector/0.110.1
Patch
https://launchpad.net/ubuntu/+source/language-selector/0.79.4
Patch
https://launchpad.net/ubuntu/+source/language-selector/0.90.1
Patch

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ubuntu_developers:language-selector:0.79:*:*:*:*:*:*:*

cpe:2.3:a:ubuntu_developers:language-selector:0.79.1:*:*:*:*:*:*:*

cpe:2.3:a:ubuntu_developers:language-selector:0.79.2:*:*:*:*:*:*:*

cpe:2.3:a:ubuntu_developers:language-selector:0.79.3:*:*:*:*:*:*:*

cpe:2.3:a:ubuntu_developers:language-selector:0.90:*:*:*:*:*:*:*

cpe:2.3:a:ubuntu_developers:language-selector:0.110:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.00062

Низкий

4.6 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2013-1066

ubuntu

больше 12 лет назад

GHSA-vjq3-454q-w3j4

github

больше 3 лет назад