diff options
| author | nobutaka <nobutaka@FreeBSD.org> | 2005-03-02 21:17:24 +0800 |
|---|---|---|
| committer | nobutaka <nobutaka@FreeBSD.org> | 2005-03-02 21:17:24 +0800 |
| commit | b04ade7a8219bc19e51508dfdefba8204a1a41a8 (patch) | |
| tree | 41c36cd14801514e1376fc8746dc848636114a22 /security | |
| parent | f54719bbf4adb533dabaab1283520529a2f885c7 (diff) | |
| download | freebsd-ports-graphics-b04ade7a8219bc19e51508dfdefba8204a1a41a8.tar.gz freebsd-ports-graphics-b04ade7a8219bc19e51508dfdefba8204a1a41a8.tar.zst freebsd-ports-graphics-b04ade7a8219bc19e51508dfdefba8204a1a41a8.zip | |
Document the privilege escalation vulnerability in uim.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 3521905a34b..befbe327b21 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,39 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="fb03b1c6-8a8a-11d9-81f7-02023f003c9f"> + <topic>uim -- privilege escalation vulnerability</topic> + <affects> + <package> + <name>ja-uim</name> + <range><lt>0.4.6</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The uim developers reports:</p> + <blockquote cite="http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html"> + <p>Takumi ASAKI discovered that uim always trusts environment variables. + But this is not correct behavior, sometimes environment variables + shouldn't be trusted. This bug causes privilege escalation when libuim + is linked against setuid/setgid application. Since GTK+ prohibits + setuid/setgid applications, the bug appears only in 'immodule for Qt' + enabled Qt. (Normal Qt is also safe.)</p> + </blockquote> + </body> + </description> + <references> + <cvename>CAN-2005-0503</cvename> + <mlist>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html</mlist> + <bid>12604</bid> + <url>http://secunia.com/advisories/13981</url> + </references> + <dates> + <discovery>2005-02-21</discovery> + <entry>2005-03-01</entry> + </dates> + </vuln> + <vuln vid="bdad9ada-8a52-11d9-9e53-000a95bc6fae"> <topic>lighttpd -- script source disclosure vulnerability</topic> <affects> |