[arch-security] [ASA-201601-30] blueman: privilege escalation
rgacogne at archlinux.org
Mon Jan 25 22:17:02 UTC 2016
Arch Linux Security Advisory ASA-201601-30
Date : 2016-01-25
CVE-ID : CVE-2015-8612
Package : blueman
Type : privilege escalation
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package blueman before version 2.0.3-1 is vulnerable to local
Upgrade to 2.0.3-1.
# pacman -Syu "blueman>=2.0.3-1"
The problem has been fixed upstream in version 2.0.3.
A local privilege escalation vulnerability has been found in the
Network::EnableNetwork() method of blueman. An unsanitized string is
received over DBUS into the dhcp_handler parameter and passed to eval(),
thus allowing arbitrary command execution with the privileges of the
user running blueman.
A local attacker can use this vulnerability to get root access on the
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security