CVE-2015-3218: polkit_project polkit

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

+0.02 pp

From 0.41% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

14 links

lists.freedesktop.org/archives/polkit-devel/2015-May/000420.htmlMailing ListX Refsource MLISTREPORT
usn.ubuntu.com/3717-1/Vendor AdvisoryX Refsource UBUNTU
lists.fedoraproject.org/pipermail/package-announce/2015-July/161721.htmlVendor AdvisoryX Refsource FEDORA
lists.opensuse.org/opensuse-updates/2015-11/msg00042.htmlVendor AdvisoryX Refsource SUSE
lists.fedoraproject.org/pipermail/package-announce/2015-July/162294.htmlVendor AdvisoryX Refsource FEDORA
lists.freedesktop.org/archives/polkit-devel/2015-July/000432.htmlMailing ListX Refsource MLIST
www.securityfocus.com/bid/76086VDB EntryX Refsource BID
lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.htmlVendor AdvisoryX Refsource SUSE
www.securitytracker.com/id/1035023VDB EntryX Refsource SECTRACK
lists.freedesktop.org/archives/polkit-devel/2015-May/000421.htmlMailing ListX Refsource MLIST

Show all 14 references

ubuntu.com/security/CVE-2015-3218REPORT
ubuntu.com/security/notices/USN-3717-1Advisory
www.cve.org/CVERecord?id=CVE-2015-3218REPORT
security-tracker.debian.org/tracker/CVE-2015-3218Advisory

Related vulnerabilities

CVE-2018-1116canonicalubuntu_linux+151.20%8y ago10-07-2018 19:00A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.CVE-2018-19788alpinepolkit+2911.58%7y ago03-12-2018 06:00A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.CVE-2013-4288canonicalubuntu_linux+90.34%13y ago03-10-2013 21:00Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.CVE-2021-4115canonicalubuntu_linux+280.53%4y ago21-02-2022 00:00There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned CVE-2021-4034canonicalubuntu_linux+79KEVRansomware94.92%4y ago28-01-2022 00:00A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.CVE-2021-3560canonicalubuntu_linux+49KEV23.71%4y ago16-02-2022 00:00It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

All vulnerabilities inpolkit

CVE-2015-3218: polkit_project polkit

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References