CVE-2005-3149

NameCVE-2005-3149
DescriptionUim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-895-1, DTSA-22-1
Debian Bugs331620

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
uim (PTS)bullseye1:1.8.8-9fixed
bookworm1:1.8.8-9.2fixed
trixie1:1.8.8-9.5fixed
sid1:1.8.8-10fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
uimsourcesarge1:0.4.6final1-3sarge1DSA-895-1
uimsourceetch1:0.4.7-2.0etch1DTSA-22-1
uimsource(unstable)1:0.4.7-2medium331620
Search for package or bug name: Reporting problems