CVE-2005-0503

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.freedesktop.org/archives/uim/2005-February/000996.htmlVendor Advisory
http://secunia.com/advisories/13981Patch, Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:046
http://www.securityfocus.com/bid/12604Patch, Vendor Advisory
http://lists.freedesktop.org/archives/uim/2005-February/000996.htmlVendor Advisory
http://secunia.com/advisories/13981Patch, Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:046
http://www.securityfocus.com/bid/12604Patch, Vendor Advisory

Timeline

Published: Feb 21, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-05044.6Buffer overflow in the MoxaDriverIoctl function for the moxa serial driver (moxa.c) in Linux 2.2.x, 2.4.x, and 2.6.x before 2.6.22 allows lo CVE-2005-05057.5Unknown vulnerability in Information Resource Manager (IRM) before 1.5.2.1 allows remote attackers to have "potentially serious" impact, rel CVE-2005-05065.0The Avaya IP Office Phone Manager, and other products such as the IP Softphone, stores sensitive data in cleartext in a registry key, which CVE-2005-05075.0Directory traversal vulnerability in SD Server 4.0.70 and earlier allows remote attackers to read arbitrary files via .. sequences in an HTT CVE-2005-05084.6Unknown vulnerability in Squiggle for Batik before 1.5.1 allows attackers to bypass certain access controls via certain features of the Rhin CVE-2005-05094.3Multiple cross-site scripting (XSS) vulnerabilities in the Mono 1.0.5 implementation of ASP.NET (.Net) allow remote attackers to inject arbi CVE-2005-05102.1The daemon for fallback-reboot before 0.995 allows attackers to cause a denial of service (daemon exit), possibly related to verbose debug m CVE-2005-05117.5misc.php for vBulletin 3.0.6 and earlier, when "Add Template Name in HTML Comments" is enabled, allows remote attackers to execute arbitrary CVE-2005-05127.5PHP remote file inclusion vulnerability in Tar.php in Mambo 4.5.2 allows remote attackers to execute arbitrary PHP code by modifying the mos CVE-2005-05137.5PHP remote file inclusion vulnerability in mail_autocheck.php in the Email This Entry add-on for pMachine Pro 2.4, and possibly other versio CVE-2005-05144.3Cross-site scripting (XSS) vulnerability in Verity Ultraseek before 5.3.3 allows remote attackers to inject arbitrary HTML and web script vi CVE-2005-05152.1Smc.exe in My Firewall Plus 5.0 build 1117, and possibly other versions, does not drop privileges before launching the Log Viewer export fun