Gentoo update for polkit



| Updated: 2016-11-15
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2015-3255
CWE-ID CWE-264
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Gentoo Linux
Operating systems & Components / Operating system

Vendor Gentoo

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU32408

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2015-3255

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to read and manipulate data.

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

Mitigation

Update the affected packages.
sys-auth/polkit to version: 0.113

Vulnerable software versions

Gentoo Linux: All versions

CPE2.3 External links

https://security.gentoo.org/
https://security.gentoo.org/glsa/201611-07


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###