A privilege escalation flaw was found in NetworkManager-vpnc, the vpnc VPN plugin for NetworkManager. This is an incomplete fix for CVE-2018-10900: the original patch rejected embedded newline and carriage-return characters in connection profile properties, but only for ITEM_TYPE_STRING and ITEM_TYPE_SECRET types, leaving ITEM_TYPE_PATH properties such as the CA-File path unprotected. A local unprivileged user can set a CA-File path containing an embedded newline character, which is legal in Unix filenames. nm-vpnc-service writes this value unfiltered into vpnc's configuration, allowing the newline to split it into additional directives, including a "Password helper" directive. When the malicious VPN connection is activated and vpnc processes Xauth authentication, it executes the injected helper via execl() as root, resulting in local privilege escalation to root.