CVE-2015-4625
Ubuntu Security Notice USN-3717-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
Desbordamiento de entero en la función authentication_agent_new_cookie en PolicyKit (también conocido como polkit) en versiones anteriores a 0.113 permite a usuarios locales obtener privilegios mediante la creación de un número de conexiones grande, lo que desencadena la emisión de un valor de cookie duplicado.
Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. It was discovered that PolicyKit incorrectly handled certain duplicate action IDs. A local attacker could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate privileges. This issue only affected Ubuntu 14.04 LTS. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-06-16 CVE Reserved
- 2015-10-26 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-189: Numeric Errors
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html | Mailing List | |
| http://lists.freedesktop.org/archives/polkit-devel/2015-June/000427.html | Mailing List | |
| http://lists.freedesktop.org/archives/polkit-devel/2015-May/000419.html | Mailing List | |
| http://www.openwall.com/lists/oss-security/2015/06/08/3 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2015/06/09/1 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2015/06/16/21 | Mailing List |
|
| http://www.securityfocus.com/bid/75267 | Vdb Entry | |
| http://www.securitytracker.com/id/1035023 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 21 Search vendor "Fedoraproject" for product "Fedora" and version "21" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 22 Search vendor "Fedoraproject" for product "Fedora" and version "22" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.2 Search vendor "Opensuse" for product "Opensuse" and version "13.2" | - |
Affected
| ||||||
| Polkit Project Search vendor "Polkit Project" | Polkit Search vendor "Polkit Project" for product "Polkit" | <= 0.112 Search vendor "Polkit Project" for product "Polkit" and version " <= 0.112" | - |
Affected
| ||||||