CVE-2005-3149 Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allo...
MediumCVSS 4.6
EPSS 0.41%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uim | <= 0.5.0 | No fix listed |
| debian/uim(Debian:12) | < 1:0.4.7-2 | 1:0.4.7-2 |
| debian/uim(Debian:13) | < 1:0.4.7-2 | 1:0.4.7-2 |
| debian/uim(Debian:14) | < 1:0.4.7-2 | 1:0.4.7-2 |
References
- bugs.debian.org patch
- [Uim] 20050928 uim-0.4.9.1 released mailing-list patch
- [Uim] 20050928 uim 0.5.0.1 released mailing-list patch
- 17043 patch third-party-advisory vendor-advisory
- 17058 third-party-advisory
- 17572 third-party-advisory
- 1015002 vdb-entry
- DSA-895 vendor-advisory
- GLSA-200510-03 patch vendor-advisory
- 15007 vdb-entry
- ADV-2005-1946 vdb-entry
- ADV-2005-1947 vdb-entry
- Debian Security Tracker CVE-2005-3149 vendor-advisory
- bugs.debian.org issue-tracking