PT-2005-5563 · Uim · Uim
Masanari Yamamoto
·
Publicado
1970-01-01
·
Atualizado
2011-03-08
·
CVE-2005-3149
CVSS v2.0
4.6
Média
| Vetor | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Uim versions prior to 0.4.9.1
Uim version 0.5.0 and earlier
Description
The issue concerns multiple vulnerabilities in the Uim package, which can lead to a breach of confidentiality, integrity, and availability of protected information. Specifically, Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the
LIBUIM VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt. This allows local users to gain privileges.Recommendations
For Uim versions prior to 0.4.9.1, update to version 0.4.9.1 or later to resolve the issue.
For Uim version 0.5.0 and earlier, update to a version later than 0.5.0 to resolve the issue.
As a temporary workaround, consider restricting access to suid or sgid applications linked to libuim to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Uim