CVE-2013-1061

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Published: Oct 3, 2013
Updated: Nov 9, 2025
CVE: CVE-2013-1061
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.6
AV:L/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-264

Affected Software
References

Software	From	Fixed in
marc_deslauriers / software-properties	0.92.17.2	0.92.17.2.x
marc_deslauriers / software-properties	0.82.7.1	0.82.7.1.x
marc_deslauriers / software-properties	0.82.7	0.82.7.x
marc_deslauriers / software-properties	0.82.7.2	0.82.7.2.x
marc_deslauriers / software-properties	0.82.7.4	0.82.7.4.x
marc_deslauriers / software-properties	0.92.9	0.92.9.x
marc_deslauriers / software-properties	0.92.17	0.92.17.x
marc_deslauriers / software-properties	0.92.17.1	0.92.17.1.x
marc_deslauriers / software-properties	0.82.7.3	0.82.7.3.x
marc_deslauriers / software-properties	0.92.9.1	0.92.9.1.x
marc_deslauriers / software-properties	0.92.9.2	0.92.9.2.x
canonical / ubuntu_linux	13.04	13.04.x
canonical / ubuntu_linux	12.10	12.10.x
canonical / ubuntu_linux	12.04	12.04.x

Vulnerability Database

313,359

CVE-2013-1061

Deep Security Visibility Without the Complexity