Pardus Software
Monthly
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the Pardus Linux application/software center) affects versions up to and including 1.0.4 and is fixed in 1.0.5. A low-privileged local user can abuse a missing authorization check (CWE-862) to inject attacker-controlled arguments into a privileged backend operation, and because the CVSS scope is Changed with High confidentiality, integrity, and availability impact, this realistically yields code execution or full compromise of the underlying system. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the 8.8 CVSS and scope change make it a serious local escalation issue.
Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the software-center application for the Turkish Pardus Linux distribution) affects all versions up to and including 1.0.4. A low-privileged local user can smuggle attacker-controlled argument delimiters into a command the application invokes with elevated privileges, yielding full compromise of the host (confidentiality, integrity, and availability all high) with no user interaction. No public exploit has been identified at time of analysis, and the issue is not on CISA KEV; it is fixed in version 1.0.5.
Local privilege escalation in Pardus-software (the software center for TUBITAK BILGEM's Pardus Linux distribution) allows a low-privileged local user to gain full system control. The flaw stems from incorrect privilege assignment (CWE-266), where the application grants elevated permissions to processes or objects that should operate with restricted rights, enabling an authenticated local user to escalate to root or equivalent. Versions before 1.0.5 are affected; no public exploit or active exploitation has been identified at time of analysis.
Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the Pardus Linux application/software center) affects versions up to and including 1.0.4 and is fixed in 1.0.5. A low-privileged local user can abuse a missing authorization check (CWE-862) to inject attacker-controlled arguments into a privileged backend operation, and because the CVSS scope is Changed with High confidentiality, integrity, and availability impact, this realistically yields code execution or full compromise of the underlying system. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the 8.8 CVSS and scope change make it a serious local escalation issue.
Local privilege escalation via argument injection in TUBITAK BILGEM's pardus-software (the software-center application for the Turkish Pardus Linux distribution) affects all versions up to and including 1.0.4. A low-privileged local user can smuggle attacker-controlled argument delimiters into a command the application invokes with elevated privileges, yielding full compromise of the host (confidentiality, integrity, and availability all high) with no user interaction. No public exploit has been identified at time of analysis, and the issue is not on CISA KEV; it is fixed in version 1.0.5.