CVE-2015-3255
Fixed in a distro release EPSS <1%
The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.
Products: polkit_project polkit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | policykit-1 | 0.105-12 |
| Debian 13 | policykit-1 | 0.105-12 |
| Debian 14 | policykit-1 | 0.105-12 |
| SUSE Linux Enterprise Desktop 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Server 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Software Development Kit 12 | polkit | 0.113-4.1 |
| SUSE Linux Enterprise Workstation Extension 12 | polkit | 0.113-4.1 |
| Ubuntu 14.04 LTS | policykit-1 | 0.105-4ubuntu3.14.04.2 |
| Ubuntu 16.04 LTS | policykit-1 | 0.105-14.1ubuntu0.1 |
| Ubuntu 18.04 LTS | policykit-1 | 0.105-20ubuntu0.18.04.1 |