Skip to content
OpenAdvisories
Unscored CVE-2021-25630 EUVD-2021-12526

"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolf…

Published Feb 23, 2021 · Updated Sep 16, 2024 · Assigned by Document Fdn.

Description

"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this check was wrong, so a normal user could start "loolforkit" and eventually get local root privileges.

Affected products

VendorProductAffectedFixed
Collabora Productivity Collabora Online Collabora Online 4.2 – < 4.2.13, Collabora Online 6.4 – < 6.4.3 4.2.13
The Document Foundation LibreOffice Online unspecified – ≤ 7.0.1.1 —

References