Vulnerability Database

296,869

Total vulnerabilities in the database

CVE-2013-4324

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

  • Published: Oct 3, 2013
  • Updated: Apr 13, 2023
  • CVE: CVE-2013-4324
  • Severity: Low
  • Exploit:

CVSS v2:

  • Severity: Low
  • Score: 4.6
  • AV:L/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
spice-gtk_project / spice-gtk 0.14 0.14.x
redhat / enterprise_linux 6.0 6.0.x