Backintime
Approved changes feed: RSS · Atom
cpe:2.3:a:backintime_project:backintime:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Backintime Project (7cdf5c12-bf1a-5491-9f0a-6d8590d659d9) |
|---|---|
| Product | Backintime (b001cf4d-b7f7-530e-b883-0a92d010e712) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/backintime |
purl2cpe | 2026-06-01 10:11:22.202608 |
pkg:deb/ubuntu/backintime |
purl2cpe | 2026-06-01 10:11:22.202612 |
pkg:github/bit-team/backintime |
purl2cpe | 2026-06-01 10:11:22.202615 |
pkg:rpm/fedora/backintime |
purl2cpe | 2026-06-01 10:11:22.202617 |
pkg:rpm/opensuse/backintime |
purl2cpe | 2026-06-01 10:11:22.202620 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-7572 |
vulnerable | 2026-06-08 05:09:56.566211 |
Details available
The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.
Published: 2017-04-06T18:00:00.000Z
Updated: 2024-09-16T16:32:59.625Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-16667 |
vulnerable | 2026-06-08 05:09:00.705784 |
Details available
backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.
Published: 2017-11-08T18:00:00.000Z
Updated: 2024-08-05T20:27:04.469Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.