Unscored severity · published Feb 21, 2005
CVE-2005-0503
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges
–
CVSS
0.4%
EPSS
No
On KEV
Description
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Mandrake Linux · Mandrakesoft
10.1; 10.1 · source: NVD
UI
Uim · Uim
0.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0503
Vendor Advisory
http://lists.freedesktop.org/archives/uim/2005-February/000996.html
Patch
http://secunia.com/advisories/13981
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2005:046
Patch
http://www.securityfocus.com/bid/12604
More from Mandrake Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
5.5
CVE-2002-1713
The Standard security setting for Mandrake-Security package (msec) in Mandrake 8.2 installs home directories with world-readable permissions, which could allow local users to read…
–
CVE-2008-0595
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls,…
–
CVE-2007-6284
The xmlCurrentChar function in libxml2 before 2.6.31 allows context-dependent attackers to cause a denial of service (infinite loop) via XML containing invalid UTF-8 sequences
–
CVE-2007-0454
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in…