https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:37:41 +0000 https://cve.radiocsirt.org/vuln/alsa-2022:0267 <p><strong>Affected:</strong> AlmaLinux:8: polkit, AlmaLinux:8: polkit-devel, AlmaLinux:8: polkit-docs, AlmaLinux:8: polkit-libs</p> <p>The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.</p> <p>Security Fix(es):</p> <p>* polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector (CVE-2021-4034)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: polkit, AlmaLinux:8: polkit-devel, AlmaLinux:8: polkit-docs, AlmaLinux:8: polkit-libs</p> <p>The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.</p> <p>Security Fix(es):</p> <p>* polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector (CVE-2021-4034)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2022:0267 https://cve.radiocsirt.org/vuln/bdu:2022-00488 bdu:2022-00488 https://cve.radiocsirt.org/vuln/bdu:2022-00488 https://cve.radiocsirt.org/vuln/bell-cve-2021-4034 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2021-4034 https://cve.radiocsirt.org/vuln/certfr-2022-avi-083 certfr-2022-avi-083 https://cve.radiocsirt.org/vuln/certfr-2022-avi-083 https://cve.radiocsirt.org/vuln/cnvd-2022-07226 cnvd-2022-07226 https://cve.radiocsirt.org/vuln/cnvd-2022-07226 https://cve.radiocsirt.org/vuln/euvd-2026-352988 EUVD-2026-352988 https://cve.radiocsirt.org/vuln/euvd-2026-352988 https://cve.radiocsirt.org/vuln/fkie_cve-2021-4034 <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-4034 https://cve.radiocsirt.org/vuln/ghsa-qgr2-xgqv-24x8 <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> https://cve.radiocsirt.org/vuln/ghsa-qgr2-xgqv-24x8 https://cve.radiocsirt.org/vuln/gsd-2021-4034 gsd-2021-4034 https://cve.radiocsirt.org/vuln/gsd-2021-4034 https://cve.radiocsirt.org/vuln/icsa-22-167-16 <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> https://cve.radiocsirt.org/vuln/icsa-22-167-16 https://cve.radiocsirt.org/vuln/msrc_cve-2021-4034 msrc_CVE-2021-4034 https://cve.radiocsirt.org/vuln/msrc_cve-2021-4034 https://cve.radiocsirt.org/vuln/oesa-2022-1502 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: polkit, openEuler:20.03-LTS-SP2: polkit, openEuler:20.03-LTS-SP3: polkit</p> <p>Define and Handle authorizations tool. Security Fix(es): A local privilege escalation vulnerability was found on polkit&amp;apos;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&amp;apos;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&amp;apos;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.(CVE-2021-4034)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: polkit, openEuler:20.03-LTS-SP2: polkit, openEuler:20.03-LTS-SP3: polkit</p> <p>Define and Handle authorizations tool. Security Fix(es): A local privilege escalation vulnerability was found on polkit&amp;apos;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&amp;apos;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&amp;apos;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.(CVE-2021-4034)</p> https://cve.radiocsirt.org/vuln/oesa-2022-1502 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0190-1 <p>Security update for polkit</p> <p>Security update for polkit</p> https://cve.radiocsirt.org/vuln/opensuse-su-2022:0190-1 https://cve.radiocsirt.org/vuln/rhsa-2022:0265 <p>polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector</p> <p>polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector</p> https://cve.radiocsirt.org/vuln/rhsa-2022:0265 https://cve.radiocsirt.org/vuln/sca-2022-0002 <p>CVE-2021-4034 is a Local Privilege Escalation (LPE) vulnerability, located in the &#34;Polkit&#34; package installed by default on almost every major distribution of the Linux operating system.</p> <p>On 2022-01-25, Qualys released an advisory for this LPE vulnerability, advising to either update the “Polkit” package or implement the mitigation that Qualys recommends.</p> <p>In an air-gapped system SICK recommends all customers to implement at least the available mitigation for the corresponding Linux distribution. Please note, that this vulnerability can be exploited only if an user with unprivileged authorization can establish a connection to the systems.</p> <p>CVE-2021-4034 is a Local Privilege Escalation (LPE) vulnerability, located in the &#34;Polkit&#34; package installed by default on almost every major distribution of the Linux operating system.</p> <p>On 2022-01-25, Qualys released an advisory for this LPE vulnerability, advising to either update the “Polkit” package or implement the mitigation that Qualys recommends.</p> <p>In an air-gapped system SICK recommends all customers to implement at least the available mitigation for the corresponding Linux distribution. Please note, that this vulnerability can be exploited only if an user with unprivileged authorization can establish a connection to the systems.</p> https://cve.radiocsirt.org/vuln/sca-2022-0002 https://cve.radiocsirt.org/vuln/suse-su-2022:0189-1 <p>Security update for polkit</p> <p>Security update for polkit</p> https://cve.radiocsirt.org/vuln/suse-su-2022:0189-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-4034 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: policykit-1, Ubuntu:Pro:16.04:LTS: policykit-1, Ubuntu:18.04:LTS: policykit-1, Ubuntu:20.04:LTS: policykit-1, Ubuntu:22.04:LTS: policykit-1</p> <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: policykit-1, Ubuntu:Pro:16.04:LTS: policykit-1, Ubuntu:18.04:LTS: policykit-1, Ubuntu:20.04:LTS: policykit-1, Ubuntu:22.04:LTS: policykit-1</p> <p>A local privilege escalation vulnerability was found on polkit&#39;s pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn&#39;t handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it&#39;ll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-4034 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0302 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0302