CVE-2012-4425
18.09.2012, 17:55
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| freedesktop | spice-gtk | - |
| gtk | libgio | - |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| glib2.0 |
| ||||||||||||||||||||||||||||||||||||||||||||||
| spice-gtk |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libspice-client-glib-2_0-8 |
| ||||||||||||||
| libspice-client-glib-helper |
| ||||||||||||||
| libspice-client-gtk-2_0-4 |
| ||||||||||||||
| libspice-client-gtk-3_0-4 |
| ||||||||||||||
| libspice-client-gtk-3_0-5 |
| ||||||||||||||
| libspice-controller0 |
| ||||||||||||||
| spice-gtk-devel |
| ||||||||||||||
| typelib-1_0-SpiceClientGlib-2_0 |
| ||||||||||||||
| typelib-1_0-SpiceClientGtk-3_0 |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
References