A race condition in polkit could allow a local attacker to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/libvirt | * | < 1.1.2-r3 | >= 1.1.2-r3 |
| net-misc/spice-gtk | * | < 0.21 | >= 0.21 |
| net-print/hplip | * | < 3.14.1 | >= 3.14.1 |
| sys-apps/systemd | * | < 204-r1 | >= 204-r1 |
| sys-auth/polkit | * | < 0.112 | >= 0.112 |
polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes.
polkit has a race condition which potentially allows a process to change its UID/EUID via suid or pkexec before authentication is completed.
A local attacker could start a suid or pkexec process through a polkit-enabled application, which could result in privilege escalation or bypass of polkit restrictions.
There is no known workaround at this time.
All polkit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.112"
All HPLIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/hplip-3.14.1"
All Spice-Gtk users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/spice-gtk-0.21"
All systemd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/systemd-204-r1"
All libvirt users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.1.2-r3"
Multiple vulnerabilities have been found in HPLIP, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-print/hplip | * | < 3.11.10 | >= 3.11.10 |
The Hewlett-Packard Linux Imaging and Printing system (HPLIP) provides drivers for HP's inkjet and laser printers, scanners and fax machines.
Two vulnerabilities have been found in HPLIP:
A remote attacker might send specially crafted SNMP reponses, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a local attacker could perform symlink attacks to overwrite arbitrary files.
There is no known workaround at this time.
All HPLIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/hplip-3.11.10"
The hpssd daemon might allow local attackers to execute arbitrary commands with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-print/hplip | * | < 2.7.9-r1 | >= 1.7.4a-r2 (revision), >= 2.7.9-r1 |
The Hewlett-Packard Linux Imaging and Printing system (HPLIP) provides drivers for HP's inkjet and laser printers, scanners and fax machines. It integrates with the Common UNIX Printing System (CUPS) and Scanner Access Now Easy (SANE).
Kees Cook from the Ubuntu Security team discovered that the hpssd daemon does not correctly validate user supplied data before passing it to a "popen3()" call.
A local attacker may be able to exploit this vulnerability by sending a specially crafted request to the hpssd daemon to execute arbitrary commands with the privileges of the user running hpssd, usually root.
There is no known workaround at this time.
All HPLIP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose "net-print/hplip"