Unscored severity · published Aug 19, 2014
CVE-2014-5033
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions…
–
CVSS
0.4%
EPSS
No
On KEV
Description
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Kauth · Kde
through 5.0 · source: NVD
KD
Kde4libs · Debian
All versions, or not specified · source: NVD
KD
Kdelibs · Kde
through 4.13.97; 4.10.0; 4.10.1; 4.10.2; 4.10.3; 4.10.95; +28 more · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5033
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-08/msg00012.html
quickgit.kde.org
http://quickgit.kde.org/?p=kauth.git&a=commit&h=341b7d84b6d9c03cf56905cb277b47e11c81482a
Exploit
http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=e4e7b53b71e2659adaf52691d4accc3594203b23
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1359.html
secunia.com
http://secunia.com/advisories/60385
secunia.com
http://secunia.com/advisories/60633
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation