CVEvulnerability

CVE-2014-5033

6.9 MEDIUM Published 2014-08-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-08-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-362

Description

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."

Affected configurations

• debian kde4libs • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • kde kauth (<= 5.0) • kde kdelibs (<= 4.13.97) • kde kdelibs 4.10.0 • kde kdelibs 4.10.1 • kde kdelibs 4.10.2 • kde kdelibs 4.10.3 • kde kdelibs 4.10.95 • kde kdelibs 4.10.97 • kde kdelibs 4.11.0 • kde kdelibs 4.11.1 • kde kdelibs 4.11.2 • kde kdelibs 4.11.3 • kde kdelibs 4.11.4 • kde kdelibs 4.11.5 • kde kdelibs 4.11.80 • kde kdelibs 4.11.90 • kde kdelibs 4.11.95 • kde kdelibs 4.11.97 • kde kdelibs 4.12.0 • kde kdelibs 4.12.1 • kde kdelibs 4.12.2 • kde kdelibs 4.12.3 • kde kdelibs 4.12.4 • kde kdelibs 4.12.5 • kde kdelibs 4.12.80 • kde kdelibs 4.12.90 • kde kdelibs 4.12.95 • kde kdelibs 4.12.97 • kde kdelibs 4.13.0 • kde kdelibs 4.13.1 • kde kdelibs 4.13.2 • kde kdelibs 4.13.3 • kde kdelibs 4.13.80 • kde kdelibs 4.13.90 • kde kdelibs 4.13.95

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References