CVE-2015-3255
Summary
| CVE | CVE-2015-3255 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-10-26 19:59:00 UTC |
| Updated | 2018-07-28 01:29:00 UTC |
| Description | The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Polkit Project | Polkit | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| USN-3717-2: PolicyKit vulnerabilities | Ubuntu security notices | UBUNTU | usn.ubuntu.com | |
| openSUSE-SU-2015:1927-1: moderate: Security update for polkit | SUSE | lists.opensuse.org | |
| PolicyKit Bugs Let Local Users Deny Service or Gain Elevated Privileges - SecurityTracker | SECTRACK | www.securitytracker.com | |
| 83590 – ** WARNING **: Unknown action_id '<random string>' | CONFIRM | bugs.freedesktop.org | |
| [security-announce] openSUSE-SU-2015:1734-1: important: Security update | SUSE | lists.opensuse.org | |
| polkit-0.113 released | MLIST | lists.freedesktop.org | |
| polkit: Heap-corruption on duplicate IDs (GLSA 201611-07) — Gentoo security | GENTOO | security.gentoo.org | |
| 1245673 – (CVE-2015-3255) CVE-2015-3255 polkit: Heap-corruption on duplicate ids | CONFIRM | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.