CVE-2013-1065

Published: Oct 3, 2013Modified: Apr 29, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Affected (12)

Products: Martin Pitt: Jockey · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Martin Pitt Jockey	Up to 0.9.7-0ubuntu7.10
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.1
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.2
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.3
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.4
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.5
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.6
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.7
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.8
Martin Pitt Jockey	Version 0.9.7-0ubuntu7.9
Martin Pitt Jockey	Version 0.9.7-0ubuntu7