[Pkg-utopia-maintainers] Bug#1109334: policykit-1: CVE-2025-7519

[Moritz Mühlenhoff]

Package: policykit-1
X-Debbugs-CC: team at security.debian.org
Severity: normal
Tags: security

Hi,

The following vulnerability was published for policykit-1.

CVE-2025-7519[0]:
| A flaw was found in polkit. When processing an XML policy with 32 or
| more nested elements in depth, an out-of-bounds write can be
| triggered. This issue can lead to a crash or other unexpected
| behavior, and arbitrary code execution is not discarded. To exploit
| this flaw, a high-privilege account is needed as it's required to
| place the malicious policy file properly.

Labelling this a security issue seems to be a bit of a stretch...

https://bugzilla.redhat.com/show_bug.cgi?id=2379675
Fixed by: https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-7519
    https://www.cve.org/CVERecord?id=CVE-2025-7519

Please adjust the affected versions in the BTS as needed.