Vulnerability Report

CVE-2012-4425

Title: Freedesktop Spice-Gtk RCE

Auth Bypass

Proof Of Concept

PoC Available for CVE-2012-4425

CWE Category CWE-264

Published Date Sep 18, 2012

Modified Date Jun 16, 2026

Exploit Status Available

Score 6.9 CVSS v2.0

Exploit Probability (EPSS)

1.09%

Vulnerability Summary

CVE-2012-4425: libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.

Impacted Vendors

freedesktop 1

gtk 1

spice-gtk_project 1

Reference Links

http://permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/853051 http://rhn.redhat.com/errata/RHSA-2012-1284.html http://www.exploit-db.com/exploits/21323 http://www.openwall.com/lists/oss-security/2012/09/12/6 http://www.openwall.com/lists/oss-security/2012/09/14/2 http://www.openwall.com/lists/oss-security/2012/09/17/2 http://www.securityfocus.com/bid/55555 http://www.spinics.net/lists/spice-devel/msg01940.html https://bugzilla.redhat.com/show_bug.cgi?id=857283 http://permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/853051 http://rhn.redhat.com/errata/RHSA-2012-1284.html http://www.exploit-db.com/exploits/21323 http://www.openwall.com/lists/oss-security/2012/09/12/6 http://www.openwall.com/lists/oss-security/2012/09/14/2 http://www.openwall.com/lists/oss-security/2012/09/17/2 http://www.securityfocus.com/bid/55555 http://www.spinics.net/lists/spice-devel/msg01940.html https://bugzilla.redhat.com/show_bug.cgi?id=857283

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.9

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:M/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2012-4425 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/21323

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 29, 2026 MODIFIED

Vulnerability data updated via NVD.

April 11, 2025 MODIFIED

Vulnerability data or affected products updated.

September 18, 2012 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected Stack

No specific products linked.