CVE-2018-1116
10.07.2018, 19:29
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| debian | debian_linux | 8.0 |
| canonical | ubuntu_linux | 12.04 |
| polkit_project | polkit | 𝑥 < 0.115 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libpolkit-agent-1-0-121 |
| ||||||||||||||||||||||||||||||||||||||
| libpolkit-gobject-1-0-121 |
| ||||||||||||||||||||||||||||||||||||||
| libpolkit0 |
| ||||||||||||||||||||||||||||||||||||||
| pkexec-121 |
| ||||||||||||||||||||||||||||||||||||||
| polkit |
| ||||||||||||||||||||||||||||||||||||||
| polkit-121 |
| ||||||||||||||||||||||||||||||||||||||
| polkit-devel |
| ||||||||||||||||||||||||||||||||||||||
| polkit-devel-121 |
| ||||||||||||||||||||||||||||||||||||||
| typelib-1_0-Polkit-1_0 |
| ||||||||||||||||||||||||||||||||||||||
| typelib-1_0-Polkit-1_0-121 |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
- CWE-285 - Improper AuthorizationThe software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-862 - Missing AuthorizationThe software does not perform an authorization check when an actor attempts to access a resource or perform an action.
References