PT-2015-6125 · Polkit+3 · Policykit+3

Vasyl Kaigorodov · Published 2015-07-02 · Updated 2018-07-28 · CVE-2015-3255

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PolicyKit (aka polkit) versions prior to 0.113

Description The issue is related to the polkit backend action pool init function in polkitbackend/polkitbackendactionpool.c, which might allow local users to gain privileges via duplicate action IDs in action descriptions.

Recommendations For versions prior to 0.113, update to version 0.113 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2015-1588

CVE-2015-3255

MGASA-2015-0262

OPENSUSE-SU-2015_1734-1

OPENSUSE-SU-2024:10436-1

SUSE-SU-2015:1838-1

USN-3717-1

USN-3717-2

Affected Products

Alt Linux

Policykit

Suse

Ubuntu

References · 62

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4625 · Security Note
• https://bdu.fstec.ru/vul/2015-06855 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3218 · Security Note
• https://advisories.mageia.org/MGASA-2015-0262.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3255 · Vendor Advisory
• https://security.gentoo.org/glsa/201611-07 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3255 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-4625 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11975 · Security Note
• https://bdu.fstec.ru/vul/2015-06856 · Security Note
• https://ubuntu.com/security/CVE-2015-3218 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1838-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3255 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3256 · Security Note