CVE-2005-3149

NameCVE-2005-3149
DescriptionUim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-895-1, DTSA-22-1
NVD severitymedium (attack range: local)
Debian Bugs331620

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
uim (PTS)wheezy1:1.8.1-4fixed
jessie1:1.8.6-8fixed
stretch1:1.8.6+gh20161003.0.d63dadd-2fixed
buster1:1.8.6+gh20161003.0.d63dadd-4fixed
sid1:1.8.6+gh20161003.0.d63dadd-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
uimsource(unstable)1:0.4.7-2medium331620
uimsourceetch1:0.4.7-2.0etch1mediumDTSA-22-1
uimsourcesarge1:0.4.6final1-3sarge1mediumDSA-895-1

Search for package or bug name: Reporting problems