CVE-2012-5617

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
gksu-polkit	gksu-polkit	through 2012-12-03

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113182.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113218.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099739.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2012/12/12/8Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/56918Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5617Issue Tracking
https://security-tracker.debian.org/tracker/CVE-2012-5617Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113182.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113218.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099739.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2012/12/12/8Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/56918Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5617Issue Tracking
https://security-tracker.debian.org/tracker/CVE-2012-5617Third Party Advisory

Timeline

Published: Nov 25, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56189.8Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.CVE-2012-56192.1The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which .CVE-2012-56215.0lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL conn CVE-2012-56226.8Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in O CVE-2012-56237.5Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords.CVE-2012-56244.3The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force CVE-2012-56256.5OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical v CVE-2012-56267.5EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Por CVE-2012-56274.0Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executio CVE-2012-56284.4gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of service CVE-2012-56297.5The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CVE-2012-56306.3libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.