CVE-2005-0503 uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.
MediumCVSS 4.6
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uim | = 0.4.5 | No fix listed |
| mandrakesoft mandrake linux | = 10.1 | No fix listed |
| debian/uim(Debian:12) | < 1:0.4.6beta2-1 | 1:0.4.6beta2-1 |
| debian/uim(Debian:13) | < 1:0.4.6beta2-1 | 1:0.4.6beta2-1 |
| debian/uim(Debian:14) | < 1:0.4.6beta2-1 | 1:0.4.6beta2-1 |
References
- [uim] 20050220 uim 0.4.5.1 released mailing-list vendor-advisory
- 13981 patch third-party-advisory vendor-advisory
- MDKSA-2005:046 vendor-advisory
- 12604 patch vdb-entry vendor-advisory
- Debian Security Tracker CVE-2005-0503 vendor-advisory