Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-85498

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Polkit Project Redhat
Products
Polkit Enterprise Linux Hummingbird and 2 more
CVE-2021-3560

polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync()

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS 21.8% KEV · Listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 7 more
CVE-2021-4034

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVSS 3.1 · 7.8 High EPSS 94.9% KEV · Listed
Vendors
Canonical Oracle Polkit Project and 4 more
Products
Ubuntu Linux Http Server Zfs Storage Appliance Kit and 34 more
CVE-2015-4625

polkit: potential information disclosure vulnerability due to cookie counter wrapping

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Opensuse Polkit Project
Products
Fedora Opensuse Polkit
CVE-2015-3256

polkit: Memory corruption via javascript rule evaluation

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Polkit Project Redhat
Products
Opensuse Polkit Enterprise Linux
CVE-2015-3218

polkit: crash authentication_agent_new with invalid object path in RegisterAuthenticationAgent

The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Polkit Project
Products
Polkit
CVE-2015-3255

polkit: Heap-corruption on duplicate ids

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Polkit Project
Products
Polkit
CVE-2013-4288

polkit: unix-process subject for authorization is racy

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Opensuse Polkit Project and 1 more
Products
Ubuntu Linux Opensuse Polkit and 1 more
CVE-2021-4115

polkit: file descriptor leak allows an unprivileged user to cause a crash

There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-6133

polkit: Temporary auth hijacking via PID reuse and non-atomic fork

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 9 more
CVE-2018-1116

polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

CVSS 3.1 · 4.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 1 more
CVE-2018-19788

polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.

CVSS 3.0 · 8.8 High EPSS 11.6% KEV · Not listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 2 more