CVE-2015-3218
Fixed in a distro release EPSS <1%
The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.
Products: polkit_project polkit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | policykit-1 | 0.105-11 |
| Debian 13 | policykit-1 | 0.105-11 |
| Debian 14 | policykit-1 | 0.105-11 |
| SUSE Linux Enterprise Desktop 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Server 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Software Development Kit 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Workstation Extension 12 | polkit | 0.113-4.1 |
| Ubuntu 14.04 LTS | policykit-1 | 0.105-4ubuntu3.14.04.2 |
| Ubuntu 16.04 LTS | policykit-1 | 0.105-14.1ubuntu0.1 |
| Ubuntu 18.04 LTS | policykit-1 | 0.105-20ubuntu0.18.04.1 |