Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
91
security advisorygentooprivilege escalationGentoo Linux GLSA 202310-15 High: USBView Privilege Escalation Risk
A vulnerability has been discovered in usbview where certain users can trigger a privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202310-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: USBView: root privilege escalation via insecure polkit settings Date: October 26, 2023 Bugs: #831756 ID: 202310-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability has been discovered in usbview where certain users can trigger a privilege escalation. Background ========== USBView is a tool to display the topology of devices on the USB bus. Affected packages ================= Package Vulnerable Unaffected ----------------- ------------ ------------ app-admin/usbview < 2.2 > = 2.2 Description =========== A vulnerability has been discovered in usbview. Please review the CVE identifier referenced below for details. Impact ====== USBView allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. Workaround ========== There is no known workaround at this time. Resolution ========== All USBView users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-admin/usbview-2.2" References ========== [ 1 ] CVE-2022-23220 https://nvd.nist.gov/vuln/detail/CVE-2022-23220 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202310-15 Concerns? ========= Security is a primary focus ofGentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Oct 26, 2023
Gentoo
89
security advisorymoderateupdateFedora 35: FEDORA-2022-421e65c5d4 Moderate: usbview Update 3.0
* Update to 3.0 (fixes (CVE-2022-23220) * Move to upstream desktop/polkit policy * Use %%license * Cleanup spec * Stop using debugfs unnecessarily. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-421e65c5d4 2022-02-01 01:11:23.956393 --------------------------------------------------------------------------------Name : usbview Product : Fedora 35 Version : 3.0 Release : 1.fc35 URL : http://www.kroah.com/linux-usb/ Summary : USB topology and device viewer Description : Display information about the topology of the devices connected to the USB bus on a Linux machine. It also displays detailed information on the individual devices. --------------------------------------------------------------------------------Update Information: * Update to 3.0 (fixes (CVE-2022-23220) * Move to upstream desktop/polkit policy * Use %%license * Cleanup spec * Stop using debugfs unnecessarily --------------------------------------------------------------------------------ChangeLog: * Sat Jan 22 2022 FeRD (Frank Dana> - 3.0-1 - New upstream release * Sat Jan 22 2022 Peter Robinson - 2.2-1 - Update to 2.2 (fixes (CVE-2022-23220) - Move to upstream desktop/polkit policy - Use %license - Cleanup spec * Sat Jan 22 2022 Fedora Release Engineering - 2.0-20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-421e65c5d4' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 31, 2022
Fedora
89
security advisoryupdatecriticalFedora 34: FEDORA-2022-256142639c Critical: Usbview Software Fix
* Update to 3.0 (fixes (CVE-2022-23220) * Move to upstream desktop/polkit policy * Use %%license * Cleanup spec * Stop using debugfs unnecessarily. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-256142639c 2022-02-01 01:05:50.764911 --------------------------------------------------------------------------------Name : usbview Product : Fedora 34 Version : 3.0 Release : 1.fc34 URL : http://www.kroah.com/linux-usb/ Summary : USB topology and device viewer Description : Display information about the topology of the devices connected to the USB bus on a Linux machine. It also displays detailed information on the individual devices. --------------------------------------------------------------------------------Update Information: * Update to 3.0 (fixes (CVE-2022-23220) * Move to upstream desktop/polkit policy * Use %%license * Cleanup spec * Stop using debugfs unnecessarily --------------------------------------------------------------------------------ChangeLog: * Sat Jan 22 2022 FeRD (Frank Dana> - 3.0-1 - New upstream release * Sat Jan 22 2022 Peter Robinson - 2.2-1 - Update to 2.2 (fixes (CVE-2022-23220) - Move to upstream desktop/polkit policy - Use %license - Cleanup spec * Sat Jan 22 2022 Fedora Release Engineering - 2.0-20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild * Fri Jul 23 2021 Fedora Release Engineering - 2.0-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-256142639c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project canbe found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 31, 2022
•Critical
Fedora
87
security advisorycriticaldebianDebian: DSA-5052-1 Critical: usbview Privilege Escalation
Matthias Gerstner reported that usbview, a USB device viewer, does not properly handle authorization in the PolicyKit policy configuration, which could result in root privilege escalation. . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5052-1
Jan 21, 2022
•Critical
Debian
172
security advisorydenial of serviceubuntuUbuntu 21.10: USN-5249-1 Moderate: usbview Administrative Access
USBView could be made to crash or run programs as an administrator.. =========================================================================Ubuntu Security Notice USN-5249-1 January 21, 2022 usbview vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: USBView could be made to crash or run programs as an administrator. Software Description: - usbview: USB device viewer Details: It was discovered that USBView allowed unprivileged users to run usbview as root. A local attacker could use this vulnerability to gain administrative privileges or cause a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: usbview 2.0-21-g6fe2f4f-2ubuntu0.21.10.3 Ubuntu 20.04 LTS: usbview 2.0-21-g6fe2f4f-2ubuntu0.20.04.1 Ubuntu 18.04 LTS: usbview 2.0-21-g6fe2f4f-1ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5249-1 CVE-2022-23220 Package Information: https://launchpad.net/ubuntu/+source/usbview/2.0-21-g6fe2f4f-2ubuntu0.21.10.3 https://launchpad.net/ubuntu/+source/usbview/2.0-21-g6fe2f4f-2ubuntu0.20.04.1 https://launchpad.net/ubuntu/+source/usbview/2.0-21-g6fe2f4f-1ubuntu1.1 . Advisory covers USBView vulnerability in Ubuntu, detailing its impact and necessary update instructions.. USBView Exploit, Ubuntu Security Notice, Administrative Privileges, DoS Attack. . Severity: Important. LinuxSecurity.com Team
Jan 21, 2022
•Important
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!