There are 2 open security issues in bullseye.
1 issue left for the package maintainer to handle:
- CVE-2021-4115:
(needs triaging)
There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit process outage duration is tied to the failing process being reaped and a new one being spawned
You can find information about how to handle this issue in the security team's documentation.
1 ignored issue:
- CVE-2016-2568:
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/policykit-1.png){kind=link}