The Superuser package for Android 4.3 allows a user to spawn /system/xbin/su with manipulated environment variables to execute code as root.
720557d982f3ef8aaa06d07b9d53d8da0492b2a5ee7ee8cdb30161f8cc7b9f96
Vulnerable releases of two common Android Superuser packages may allow malicious Android applications to execute arbitrary commands as root. These issues are due to a shell character escape vulnerability.
f6134df3ff0263a6cd72271f82d052f4901243c942b8062a434fa2292a742fab
Vulnerable releases of several common Android Superuser packages may allow malicious Android applications to execute arbitrary commands as root without notifying the device owner. This advisoriy documents PATH and BOOTCLASSPATH vulnerabilities.
12b763de306db7a0f6da5ae622fa69aa12764251a01b3dfaf8577292ab988109