Vulnerabilites related to uim - uim
Vulnerability from fkie_nvd
Published
2005-10-05 22:02
Modified
2025-04-03 01:03
Severity ?
Summary
Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
References
cve@mitre.orghttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620Patch
cve@mitre.orghttp://lists.freedesktop.org/pipermail/uim/2005-September/001346.htmlPatch
cve@mitre.orghttp://lists.freedesktop.org/pipermail/uim/2005-September/001347.htmlPatch
cve@mitre.orghttp://secunia.com/advisories/17043Patch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/17058
cve@mitre.orghttp://secunia.com/advisories/17572
cve@mitre.orghttp://securitytracker.com/id?1015002
cve@mitre.orghttp://www.debian.org/security/2005/dsa-895
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200510-03.xmlPatch, Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/15007
cve@mitre.orghttp://www.vupen.com/english/advisories/2005/1946
cve@mitre.orghttp://www.vupen.com/english/advisories/2005/1947
af854a3a-2127-422b-91ae-364da2661108http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620Patch
af854a3a-2127-422b-91ae-364da2661108http://lists.freedesktop.org/pipermail/uim/2005-September/001346.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://lists.freedesktop.org/pipermail/uim/2005-September/001347.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/17043Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/17058
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/17572
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1015002
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2005/dsa-895
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200510-03.xmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/15007
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2005/1946
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2005/1947
Impacted products
Vendor Product Version
uim uim *



{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:uim:uim:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFDA7FAD-FD2B-4BC1-B2C4-AAA0AEFCC6CA",
              "versionEndIncluding": "0.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges."
    }
  ],
  "id": "CVE-2005-3149",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2005-10-05T22:02:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/17043"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/17058"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/17572"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1015002"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2005/dsa-895"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200510-03.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/15007"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2005/1946"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2005/1947"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/17043"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/17058"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/17572"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1015002"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2005/dsa-895"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200510-03.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/15007"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2005/1946"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2005/1947"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2005-02-21 05:00
Modified
2025-04-03 01:03
Severity ?
Summary
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.
Impacted products
Vendor Product Version
uim uim 0.4.5
mandrakesoft mandrake_linux 10.1
mandrakesoft mandrake_linux 10.1



{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:uim:uim:0.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A25E233-DA22-4C24-96AE-F502B5323B2D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3528DABD-B821-4D23-AE12-614A9CA92C46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:*:x86_64:*:*:*:*:*",
              "matchCriteriaId": "9E661D58-18DF-4CCF-9892-F873618F4535",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges."
    }
  ],
  "id": "CVE-2005-0503",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2005-02-21T05:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.freedesktop.org/archives/uim/2005-February/000996.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/13981"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:046"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/12604"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://lists.freedesktop.org/archives/uim/2005-February/000996.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/13981"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:046"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.securityfocus.com/bid/12604"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2005-3149 (GCVE-0-2005-3149)
Vulnerability from cvelistv5
Published
2005-10-05 04:00
Modified
2024-08-07 23:01
Severity ?
CWE
  • n/a
Summary
Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
References
http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/15007 vdb-entry, x_refsource_BID
http://www.vupen.com/english/advisories/2005/1947 vdb-entry, x_refsource_VUPEN
http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html mailing-list, x_refsource_MLIST
http://securitytracker.com/id?1015002 vdb-entry, x_refsource_SECTRACK
http://secunia.com/advisories/17058 third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/17572 third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2005/1946 vdb-entry, x_refsource_VUPEN
http://www.debian.org/security/2005/dsa-895 vendor-advisory, x_refsource_DEBIAN
http://www.gentoo.org/security/en/glsa/glsa-200510-03.xml vendor-advisory, x_refsource_GENTOO
http://secunia.com/advisories/17043 third-party-advisory, x_refsource_SECUNIA
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620 x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T23:01:59.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[Uim] 20050928 uim 0.5.0.1 released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html"
          },
          {
            "name": "15007",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/15007"
          },
          {
            "name": "ADV-2005-1947",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/1947"
          },
          {
            "name": "[Uim] 20050928 uim-0.4.9.1 released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html"
          },
          {
            "name": "1015002",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1015002"
          },
          {
            "name": "17058",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17058"
          },
          {
            "name": "17572",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17572"
          },
          {
            "name": "ADV-2005-1946",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2005/1946"
          },
          {
            "name": "DSA-895",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2005/dsa-895"
          },
          {
            "name": "GLSA-200510-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-200510-03.xml"
          },
          {
            "name": "17043",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/17043"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-10-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2006-01-17T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[Uim] 20050928 uim 0.5.0.1 released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html"
        },
        {
          "name": "15007",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/15007"
        },
        {
          "name": "ADV-2005-1947",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/1947"
        },
        {
          "name": "[Uim] 20050928 uim-0.4.9.1 released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html"
        },
        {
          "name": "1015002",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1015002"
        },
        {
          "name": "17058",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17058"
        },
        {
          "name": "17572",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17572"
        },
        {
          "name": "ADV-2005-1946",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2005/1946"
        },
        {
          "name": "DSA-895",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2005/dsa-895"
        },
        {
          "name": "GLSA-200510-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-200510-03.xml"
        },
        {
          "name": "17043",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/17043"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-3149",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[Uim] 20050928 uim 0.5.0.1 released",
              "refsource": "MLIST",
              "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001347.html"
            },
            {
              "name": "15007",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/15007"
            },
            {
              "name": "ADV-2005-1947",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/1947"
            },
            {
              "name": "[Uim] 20050928 uim-0.4.9.1 released",
              "refsource": "MLIST",
              "url": "http://lists.freedesktop.org/pipermail/uim/2005-September/001346.html"
            },
            {
              "name": "1015002",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1015002"
            },
            {
              "name": "17058",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17058"
            },
            {
              "name": "17572",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17572"
            },
            {
              "name": "ADV-2005-1946",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2005/1946"
            },
            {
              "name": "DSA-895",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2005/dsa-895"
            },
            {
              "name": "GLSA-200510-03",
              "refsource": "GENTOO",
              "url": "http://www.gentoo.org/security/en/glsa/glsa-200510-03.xml"
            },
            {
              "name": "17043",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/17043"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620",
              "refsource": "CONFIRM",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-3149",
    "datePublished": "2005-10-05T04:00:00",
    "dateReserved": "2005-10-05T00:00:00",
    "dateUpdated": "2024-08-07T23:01:59.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2005-0503 (GCVE-0-2005-0503)
Vulnerability from cvelistv5
Published
2005-02-21 05:00
Modified
2024-08-07 21:13
Severity ?
CWE
  • n/a
Summary
uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges.
References
http://lists.freedesktop.org/archives/uim/2005-February/000996.html mailing-list, x_refsource_MLIST
http://www.mandriva.com/security/advisories?name=MDKSA-2005:046 vendor-advisory, x_refsource_MANDRAKE
http://www.securityfocus.com/bid/12604 vdb-entry, x_refsource_BID
http://secunia.com/advisories/13981 third-party-advisory, x_refsource_SECUNIA
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T21:13:54.363Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[uim] 20050220 uim 0.4.5.1 released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.freedesktop.org/archives/uim/2005-February/000996.html"
          },
          {
            "name": "MDKSA-2005:046",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRAKE",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:046"
          },
          {
            "name": "12604",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/12604"
          },
          {
            "name": "13981",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/13981"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-02-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2005-03-30T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[uim] 20050220 uim 0.4.5.1 released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.freedesktop.org/archives/uim/2005-February/000996.html"
        },
        {
          "name": "MDKSA-2005:046",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRAKE"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:046"
        },
        {
          "name": "12604",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/12604"
        },
        {
          "name": "13981",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/13981"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2005-0503",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "uim before 0.4.5.1 trusts certain environment variables when libUIM is used in setuid or setgid applications, which allows local users to gain privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[uim] 20050220 uim 0.4.5.1 released",
              "refsource": "MLIST",
              "url": "http://lists.freedesktop.org/archives/uim/2005-February/000996.html"
            },
            {
              "name": "MDKSA-2005:046",
              "refsource": "MANDRAKE",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:046"
            },
            {
              "name": "12604",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/12604"
            },
            {
              "name": "13981",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/13981"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2005-0503",
    "datePublished": "2005-02-21T05:00:00",
    "dateReserved": "2005-02-21T00:00:00",
    "dateUpdated": "2024-08-07T21:13:54.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}