1. Home
  2. CVE Database
  3. CVE-2012-4425
MEDIUM · 6.9

CVE-2012-4425

libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS envi...

Vulnerability Description

libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.

CVSS Score

6.9

MEDIUM

AV:L/AC:M/Au:N/C:C/I:C/A:C
Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE

Affected Products

VendorProductVersions
FreedesktopSpice-Gtk-
GtkLibgio-

Related Weaknesses (CWE)

CWE-264

References

FAQ

What is CVE-2012-4425?

CVE-2012-4425 is a vulnerability with a CVSS score of 6.9 (MEDIUM). libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS envi...

How severe is CVE-2012-4425?

CVE-2012-4425 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-4425?

Check the references section above for vendor advisories and patch information. Affected products include: Freedesktop Spice-Gtk, Gtk Libgio.