VulnerabilityModified
CVE-2011-1485
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
MEDIUM 6.9EPSS 5.25%
Does this matter?
Lower severity and a low EPSS score (5.25%). Track it; it rarely justifies an emergency change on its own.
Description
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 5.25% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- redhat/policykit
- Source
- secalert@redhat.com
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.htmlPatch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.htmlPatch
- http://secunia.com/advisories/48817
- http://security.gentoo.org/glsa/glsa-201204-06.xml
- http://securityreason.com/securityalert/8424
- http://www.debian.org/security/2011/dsa-2319
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:086
- http://www.redhat.com/support/errata/RHSA-2011-0455.html
- http://www.ubuntu.com/usn/USN-1117-1
- https://bugzilla.redhat.com/show_bug.cgi?id=692922Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.htmlPatch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.htmlPatch
- http://secunia.com/advisories/48817
- http://security.gentoo.org/glsa/glsa-201204-06.xml
- http://securityreason.com/securityalert/8424
- http://www.debian.org/security/2011/dsa-2319
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:086
- http://www.redhat.com/support/errata/RHSA-2011-0455.html
- http://www.ubuntu.com/usn/USN-1117-1
- https://bugzilla.redhat.com/show_bug.cgi?id=692922Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.