Uim: Privilege escalation vulnerability — GLSA 200510-03

Under certain conditions, applications linked against Uim suffer from a privilege escalation vulnerability.

Affected packages

Background

Uim is a multilingual input method library which provides secure and useful input method for all languages.

Description

Masanari Yamamoto discovered that Uim uses environment variables incorrectly. This bug causes a privilege escalation if setuid/setgid applications are linked to libuim. This bug only affects immodule-enabled Qt (if you build Qt 3.3.2 or later versions with USE="immqt" or USE="immqt-bc").

Impact

A malicious local user could exploit this vulnerability to execute arbitrary code with escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-i18n/uim-0.4.9.1"

References

• Original advisory
• CVE-2005-3149

Release date
October 04, 2005

Latest revision
May 22, 2006: 02

Severity
normal

Exploitable
local

Bugzilla entries

• 107748