Privilege Escalation Vulnerability in Language Selector by Ubuntu

CVE-2011-1842

What is CVE-2011-1842?

The Language Selector in Ubuntu prior to version 0.6.7 contains a vulnerability in its D-Bus backend, specifically within the dbus_backend/lsd.py file. It fails to properly validate input arguments for the SetSystemDefaultLangEnv and SetSystemDefaultLanguageEnv functions. This oversight allows local users to exploit the system by injecting shell metacharacters into string arguments, potentially escalating their privileges. This issue highlights the importance of input validation in ensuring the security of system functions.

References