← Back

CVE-2014-5033

nvd nist
Published: Aug 19, 2014Modified: May 6, 2026

JSON object

Loading...
6.9
Vector
AV:L/AC:M/Au:N/C:C/I:C/A:C
Exploitability: 3.4 / Impact: 10.0
Source: NVD

Description

KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."

Affected (38)

Canonical
1 product
Ubuntu Linux
Debian
1 product
Kde4libs
Kde
2 products
Kauth
Kdelibs
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Canonical
Ubuntu Linux
Version 12.04
Ubuntu Linux
Version 14.04
Kde4libs
All versions
Configuration B
35 vulnerable
Vulnerable SoftwareAffected Versions
Kauth
Up to 5.0
Kde
Kdelibs
Up to 4.13.97
Kdelibs
Version 4.10.0
Kdelibs
Version 4.10.1
Kdelibs
Version 4.10.2
Kdelibs
Version 4.10.3
Kdelibs
Version 4.10.95
Kdelibs
Version 4.10.97
Kdelibs
Version 4.11.0
Kdelibs
Version 4.11.1
Kdelibs
Version 4.11.2
Kdelibs
Version 4.11.3
Kdelibs
Version 4.11.4
Kdelibs
Version 4.11.5
Kdelibs
Version 4.11.80
Kdelibs
Version 4.11.90
Kdelibs
Version 4.11.95
Kdelibs
Version 4.11.97
Kdelibs
Version 4.12.0
Kdelibs
Version 4.12.1
Kdelibs
Version 4.12.2
Kdelibs
Version 4.12.3
Kdelibs
Version 4.12.4
Kdelibs
Version 4.12.5
Kdelibs
Version 4.12.80
Kdelibs
Version 4.12.90
Kdelibs
Version 4.12.95
Kdelibs
Version 4.12.97
Kdelibs
Version 4.13.0
Kdelibs
Version 4.13.1
Kdelibs
Version 4.13.2
Kdelibs
Version 4.13.3
Kdelibs
Version 4.13.80
Kdelibs
Version 4.13.90
Kdelibs
Version 4.13.95

Related CWEs

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (20)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
ExploitPatch
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.