CVE-2014-5033
polkit-qt: insecure calling of polkit
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
CVSS 2.0 · 6.9 Medium
EPSS < 1%
KEV · Not listed
Vendors
Products