Description
Uim 0.4.x before 0.4.9.1 and 0.5.0 and earlier does not properly handle the LIBUIM_VANILLA environment variable when a suid or sgid application is linked to libuim, such as immodule for Qt, which allows local users to gain privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-895-1 uim - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-22-1 uim - local privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- [Uim] 20050928 uim 0.5.0.1 released mailing-list
- 15007 vdb-entry
- ADV-2005-1947 vdb-entry
- [Uim] 20050928 uim-0.4.9.1 released mailing-list
- 1015002 vdb-entry
- 17058 third-party-advisory
- 17572 third-party-advisory
- ADV-2005-1946 vdb-entry
- DSA-895 vendor-advisory
- GLSA-200510-03 vendor-advisory
- 17043 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=331620