Published: 26/10/2015 Updated: 28/07/2018

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) prior to 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
polkit project polkit

Debian Bug report logs - #796134 CVE-2015-3255 CVE-2015-4625 Package: policykit-1; Maintainer for policykit-1 is Utopia Maintenance Team <pkg-utopia-maintainers@listsaliothdebianorg>; Source for policykit-1 is src:policykit-1 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Wed, 19 Aug ...

Several security issues were fixed in PolicyKit ...

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpoolc in PolicyKit (aka polkit) before 0113 might allow local users to gain privileges via duplicate action IDs in action descriptions ...

CWE-264 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html https://bugs.freedesktop.org/show_bug.cgi?id=83590 https://bugzilla.redhat.com/show_bug.cgi?id=1245673 http://www.securitytracker.com/id/1035023 http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html https://security.gentoo.org/glsa/201611-07 https://usn.ubuntu.com/3717-2/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796134 https://nvd.nist.gov https://usn.ubuntu.com/3717-2/https://access.redhat.com/security/cve/cve-2015-3255

CVE-2015-3255

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect