high7.0
CVE-2018-8885
screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypass intended access …
Impact
screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypass intended access restrictions by leveraging a race condition via a setuid or pkexec process that is mishandled in a PolicyKitService._check_permission call.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Canonical | Screen-Resolution-Extra | Version 0.17.2 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 17.10 |