CVE-2008-1658
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and...
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- Record
CVE-2008-1658- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- Record
CVE-2008-1658- Updated
- 2026-11-02
EUVDEUVD-2008-1659 No score
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- Record
EUVD-2008-1659- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mw7g-wfcq-49r3 No score
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and...
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- Record
GHSA-mw7g-wfcq-49r3- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- Record
CVE-2008-1658- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1658 No score
Format string vulnerability in the grant helper (polkit-grant-helper.c) in PolicyKit 0.7 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in a password.
- Record
DEBIAN-CVE-2008-1658- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
policykit-1Debian:12 |
before 0.8-1 | 0.8-1 |
policykit-1Debian:13 |
before 0.8-1 | 0.8-1 |
policykit-1Debian:14 |
before 0.8-1 | 0.8-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1658 is a medium vulnerability (CVSS 4.6) in Freedesktop Policykit, published April 11, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in policykit-1 0.8-1.
References
bugs.launchpad.net/ubuntu/+source/policykit/+bug/205037
mandriva.com/security/advisories?name=MDVSA-2008:087
gitweb.freedesktop.org?p=PolicyKit.git%3Ba=commitdiff%3Bh=5bc86a14cc0e356bcf8b5f861674f842869b1be7
bugs.freedesktop.org/show_bug.cgi?id=15295
exchange.xforce.ibmcloud.com/vulnerabilities/41877
securityfocus.com/bid/28702
Show 7 moreShow less
redhat.com/archives/fedora-package-announce/2008-April/msg00176.html
vupen.com/english/advisories/2008/1254
secunia.com/advisories/29755
nvd.nist.gov/vuln/detail/CVE-2008-1658
github.com/advisories/GHSA-mw7g-wfcq-49r3
security-tracker.debian.org/tracker/CVE-2008-1658