spice-gtk is vulnerable to authorization bypass. The communication to polkit for authorization via an API call is vulnerable to a race condition in setuid
or pkexec
process, which allows a local user to bypass access restrictions.
lists.opensuse.org/opensuse-updates/2013-10/msg00031.html
rhn.redhat.com/errata/RHSA-2013-1273.html
secunia.com/advisories/54947
www.openwall.com/lists/oss-security/2013/09/18/6
www.securityfocus.com/bid/62538
access.redhat.com/security/updates/classification/#important
rhn.redhat.com/errata/RHSA-2013-1273.html