CVE-2013-4327

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2013/dsa-2777Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/09/18/6Mailing List, Third Party Advisory
http://www.ubuntu.com/usn/USN-1961-1Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1006680Issue Tracking, Patch, Third Party Advisory
http://www.debian.org/security/2013/dsa-2777Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/09/18/6Mailing List, Third Party Advisory
http://www.ubuntu.com/usn/USN-1961-1Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1006680Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Oct 3, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43296.5The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough d CVE-2013-43306.8Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple langua CVE-2013-43312.1Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary CVE-2013-43324.3Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers t CVE-2013-43339.1OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability CVE-2013-43349.8opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities CVE-2013-43359.8opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities CVE-2013-43387.5wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attack CVE-2013-43397.5WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redi CVE-2013-43403.5wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the A CVE-2013-43414.3Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 CVE-2013-43427.6xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and m