Polkit CVE-2015-3256

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2015-10-26 secalert@redhat.com

Denial Of Service Privilege Escalation Buffer Overflow Polkit Opensuse

4.6

CVSS 2.0 · NVD

Share

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Local

Attack Complexity

Low

Confidentiality

P

Integrity

P

Availability

P

Lifecycle Timeline

1

CVE Published

Oct 26, 2015 - 19:59 cve.org

MEDIUM 4.6

DescriptionCVE.org

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

AnalysisAI

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation." Affected products include: Polkit Project Polkit, Opensuse. Version information: before 0.113.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Polkit

View all

CVE-2018-19788 HIGH This Week POC

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully exec

CVE-2016-2568 HIGH This Week

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl ca

CVE-2013-4288 HIGH This Week

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privilege

CVE-2019-6133 MEDIUM This Month

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and

CVE-2026-4897 MEDIUM This Month

Polkit's polkit-agent-helper-1 setuid binary fails to bound input length on stdin, allowing local authenticated users to

CVE-2015-3255 MEDIUM This Month

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before

CVE-2015-4625 MEDIUM This Month

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local use

CVE-2018-1116 MEDIUM This Month

A flaw was found in polkit before version 0.116. Rated medium severity (CVSS 4.4), this vulnerability is low attack comp

CVE-2015-3218 LOW Monitor

The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) bef

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all

CVE-2013-0422 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

CVE-2015-7709 CRITICAL POC

CVE-2014-0514 CRITICAL POC

CVE-2013-6955 CRITICAL POC

CVE-2012-0299 CRITICAL POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Share

CVE-2015-3256 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy