{"id":"CVE-2018-1116","aliases":["CLSA-2026-1780069518","CLSA-2026-1780070303","DEBIAN-CVE-2018-1116","DLA-1448-1","EUVD-2018-11760","GHSA-hjrh-286v-8qr4","RHSA-2020:1135","SUSE-SU-2018:2163-1","SUSE-SU-2018:2165-1","UBUNTU-CVE-2018-1116","USN-3717-1","openSUSE-SU-2024:11180-1"],"status":"published","title":"A flaw was found in polkit before version 0.116. The implementation of the...","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","severity":{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01196,"percentile":0.68294,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-862"],"published":"2018-07-10T00:00:00Z","modified":"2026-10-26T09:31:45Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"polkit","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"polkit-desktop-policy","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"polkit-devel","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"polkit-docs","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"polkit","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"polkit-desktop-policy","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"polkit-devel","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"polkit-docs","fixed_in":["0.96-11.el6_10.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"policykit-1","fixed_in":["0.105-21"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"policykit-1","fixed_in":["0.105-21"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"policykit-1","fixed_in":["0.105-21"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"policykit-1","fixed_in":["0.105-15~deb8u3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit-debuginfo","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit-devel","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit-docs","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit-debuginfo","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit-devel","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit-docs","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit-debuginfo","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit-devel","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit-docs","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit-debuginfo","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit-devel","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit-docs","fixed_in":["0:0.112-26.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"polkit","fixed_in":["0.113-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"polkit","fixed_in":["0.113-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"polkit","fixed_in":["0.113-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"polkit","fixed_in":["0.113-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"polkit","fixed_in":["0.113-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"polkit","fixed_in":["0.114-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"policykit-1","fixed_in":["0.105-4ubuntu3.14.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"policykit-1","fixed_in":["0.105-14.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"policykit-1","fixed_in":["0.105-20ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"polkit-desktop-policy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"polkit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"polkit-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"polkit-desktop-policy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"polkit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"polkit-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.96-11.el6_10.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-21"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-21"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-21"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-15~deb8u3"}]}],"versions":["0.105-10","0.105-11","0.105-12","0.105-13","0.105-14","0.105-14.1","0.105-15~deb8u1","0.105-15~deb8u2","0.105-8","0.105-9"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"polkit-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"polkit-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"polkit-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"polkit-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.112-26.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.113-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.114-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-4ubuntu3.14.04.2"}]}],"versions":["0.105-3ubuntu3","0.105-4ubuntu1","0.105-4ubuntu2","0.105-4ubuntu2.14.04.1","0.105-4ubuntu3.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-14.1ubuntu0.1"}]}],"versions":["0.105-11ubuntu2","0.105-13","0.105-13ubuntu1","0.105-14","0.105-14.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-20ubuntu0.18.04.1"}]}],"versions":["0.105-18","0.105-20"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-4ubuntu3.14.04.2"}]}],"versions":["0.105-3ubuntu3","0.105-4ubuntu1","0.105-4ubuntu2","0.105-4ubuntu2.14.04.1","0.105-4ubuntu3.14.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-14.1ubuntu0.1"}]}],"versions":["0.105-11ubuntu2","0.105-13","0.105-13ubuntu1","0.105-14","0.105-14.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"policykit-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.105-20ubuntu0.18.04.1"}]}],"versions":["0.105-18","0.105-20"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"polkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.118-7.2"}]}],"bundled":4}],"products":[{"vendor":"[unknown]","product":"polkit"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"polkit_project","product":"polkit"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1116","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://usn.ubuntu.com/3717-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00042.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201908-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1116","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hjrh-286v-8qr4"},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1780069518.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1780070303.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1116","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1135","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753037","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1135.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1116","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182163-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1099031","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1116","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182165-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1116","tags":["report"]},{"url":"https://lists.freedesktop.org/archives/polkit-devel/2018-July/000583.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3717-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3717-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4625","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3560","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1116","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2018-07-10T19:00:00Z","modified":"2024-08-05T03:51:48.873Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-11760","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2018-07-10T19:00:00Z","modified":"2024-08-05T03:51:48Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-hjrh-286v-8qr4","title":"A flaw was found in polkit before version 0.116. The implementation of the...","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2022-05-13T01:26:59Z","modified":"2023-02-01T05:07:49Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:50:37.203795Z"}],"nvd":[{"id":"CVE-2018-1116","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2018-07-10T19:29:00.29Z","modified":"2026-06-17T01:50:30.847Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-285","CWE-862"],"updated_at":"2026-11-02T14:04:32.929986Z"}],"osv":[{"id":"CVE-2018-1116","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2018-07-10T19:29:00.29Z","modified":"2026-10-24T10:30:24.667579908Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1116","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2018-07-10T19:29:00.29Z","modified":"2026-10-23T18:03:35.796860715Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2020:1135","title":"Red Hat Security Advisory: polkit security and bug fix update","status":"published","published":"2024-09-16T02:52:03Z","modified":"2026-07-01T10:05:42Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-1116","description":"A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.","status":"published","published":"2018-07-10T00:00:00Z","modified":"2026-04-22T11:41:59.565242Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"CLSA-2026-1780069518","title":"polkit: Fix of CVE-2018-1116","description":"- CVE-2018-1116: polkit trusts client-supplied UID in CheckAuthorization,\n  allowing a local attacker to spoof or DoS the authentication-agent dialog\n  of unrelated processes.","status":"published","published":"2026-05-29T15:45:22Z","modified":"2026-10-26T09:31:45.314111331Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780070303","title":"polkit: Fix of CVE-2018-1116","description":"- CVE-2018-1116: polkit trusts client-supplied UID in CheckAuthorization,\n  allowing a local attacker to spoof or DoS the authentication-agent dialog\n  of unrelated processes.","status":"published","published":"2026-05-30T10:24:38Z","modified":"2026-10-26T09:31:39.419124093Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-1448-1","title":"policykit-1 - security update","status":"published","published":"2018-07-28T00:00:00Z","modified":"2026-03-09T01:00:45.284361Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"openSUSE-SU-2024:11180-1","title":"libpolkit0-0.118-7.2 on GA media","description":"These are all security issues fixed in the libpolkit0-0.118-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:33.348342Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:2163-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-1116: Fix uid comparison lacking in polkit_backend_interactive_authority_check_authorization (bsc#1099031).\n","status":"published","published":"2018-08-01T11:56:54Z","modified":"2026-02-04T03:58:03.198208Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2165-1","title":"Security update for polkit","description":"This update for polkit fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-1116: Fix uid comparison lacking in polkit_backend_interactive_authority_check_authorization (bsc#1099031).\n","status":"published","published":"2018-08-01T11:59:46Z","modified":"2026-02-04T02:56:11.47727Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3717-1","title":"policykit-1 vulnerabilities","description":"Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid\nobject paths. A local attacker could possibly use this issue to cause\nPolicyKit to crash, resulting in a denial of service. This issue only\naffected Ubuntu 14.04 LTS. (CVE-2015-3218)\n\nIt was discovered that PolicyKit incorrectly handled certain duplicate\naction IDs. A local attacker could use this issue to cause PolicyKit to\ncrash, resulting in a denial of service, or possibly escalate privileges.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2015-3255)\n\nTavis Ormandy discovered that PolicyKit incorrectly handled duplicate\ncookie values. A local attacker could use this issue to cause PolicyKit to\ncrash, resulting in a denial of service, or possibly escalate privileges.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2015-4625)\n\nMatthias Gerstner discovered that PolicyKit incorrectly checked users. A\nlocal attacker could possibly use this issue to cause authentication\ndialogs to show up for other users, leading to a denial of service or an\ninformation leak. (CVE-2018-1116)\n","status":"published","published":"2018-07-16T15:17:18Z","modified":"2026-04-22T09:48:12.746006Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}