CVE-2012-4425
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products...
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
Exploit likelihood
What each source reports
NVD Score used
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
- Record
CVE-2012-4425- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
- Record
CVE-2012-4425- Updated
- 2026-11-02
EUVDEUVD-2012-4360 No score
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
- Record
EUVD-2012-4360- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c77h-vm5q-jc2m No score
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products...
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
- Record
GHSA-c77h-vm5q-jc2m- Updated
- 2026-11-02
OSV No score
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
- Record
CVE-2012-4425- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-4425 No score
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
- Record
DEBIAN-CVE-2012-4425- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10421-1 No score
libspice-client-glib-2_0-8-0.33-2.1 on GA media
These are all security issues fixed in the libspice-client-glib-2_0-8-0.33-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10421-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spice-gtkDebian:12 |
before 0.12-5 | 0.12-5 |
spice-gtkDebian:13 |
before 0.12-5 | 0.12-5 |
spice-gtkDebian:14 |
before 0.12-5 | 0.12-5 |
spice-glibRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtkRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-glib-develRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-develRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::client |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spice-glibRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtkRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-glib-develRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-develRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::computenode |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-glibRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtkRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-glib-develRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-develRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::server |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-glibRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtkRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-pythonRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-glib-develRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-develRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtk-toolsRed Hat:enterprise_linux:6::workstation |
before 0:0.11-11.el6_3.1 | 0:0.11-11.el6_3.1 |
spice-gtkopenSUSE:Tumbleweed |
before 0.33-2.1 | 0.33-2.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | libdbus - 'DBUS_SYSTEM_BUS_ADDRESS' Local Privilege Escalation | 2012-07-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-4425 is a medium vulnerability (CVSS 6.9) in Freedesktop Spice-gtk, published September 18, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in spice-gtk 0.12-5.
References
rhn.redhat.com/errata/RHSA-2012-1284.html
openwall.com/lists/oss-security/2012/09/12/6
spinics.net/lists/spice-devel/msg01940.html
permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/853051
exploit-db.com/exploits/21323
Show 12 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=857283
securityfocus.com/bid/55555
nvd.nist.gov/vuln/detail/CVE-2012-4425
github.com/advisories/GHSA-c77h-vm5q-jc2m
security-tracker.debian.org/tracker/CVE-2012-4425
access.redhat.com/errata/RHSA-2012:1284
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1284.json
cve.org/CVERecord?id=CVE-2012-4425
suse.com/security/cve/CVE-2012-4425