CVE-2012-4425
EPSS 0.55%
Description
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
How to fix CVE-2012-4425
To remediate CVE-2012-4425, upgrade the affected package to a fixed version below.
- Debian/spice-gtk—upgrade to 0.12-5 or later
Is CVE-2012-4425 being exploited?
Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.12-5