CVE-2013-4288

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

• CWE-362

• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1002375Issue Tracking, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00004.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00005.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1270.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1460.htmlThird Party Advisory
• http://seclists.org/oss-sec/2013/q3/626Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/09/18/4Mailing List, Third Party Advisory
• http://www.ubuntu.com/usn/USN-1953-1Third Party Advisory
• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1002375Issue Tracking, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00004.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00005.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1270.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1460.htmlThird Party Advisory
• http://seclists.org/oss-sec/2013/q3/626Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/09/18/4Mailing List, Third Party Advisory
• http://www.ubuntu.com/usn/USN-1953-1Third Party Advisory

Published

Oct 3, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4282Stack-based buffer overflow in the reds_handle_ticket functi…
• CVE-2013-4283ns-slapd in 389 Directory Server before 1.3.0.8 allows remot…
• CVE-2013-4284Cumin, as used in Red Hat Enterprise MRG 2.4, allows remote …
• CVE-2013-4285A certain Gentoo patch for the PAM S/Key module does not pro…
• CVE-2013-4286Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x befo…
• CVE-2013-4287Algorithmic complexity vulnerability in Gem::Version::VERSIO…
• CVE-2013-4289Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPE…
• CVE-2013-4290Stack-based buffer overflow in OpenJPEG before 1.5.2 allows …
• CVE-2013-4291The virSecurityManagerSetProcessLabel function in libvirt 0.…
• CVE-2013-4292libvirt 1.1.0 and 1.1.1 allows local users to cause a denial…
• CVE-2013-4293The server in Red Hat JBoss Operations Network (JON) 3.1.2 l…
• CVE-2013-4294The (1) mamcache and (2) KVS token backends in OpenStack Ide…