Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2018:2121-1

Опубликовано: 28 июл. 2018
Источник: suse-cvrf

Описание

Security update for cinnamon

This update for cinnamon fixes the following issues:

Security issue fixed:

  • CVE-2018-13054: Fix symlink attack vulnerability (boo#1083067).

Список пакетов

openSUSE Leap 15.0
cinnamon-3.6.7-lp150.3.3.1
cinnamon-gschemas-3.6.7-lp150.3.3.1
cinnamon-gschemas-branding-upstream-3.6.7-lp150.3.3.1

Ссылки

Описание

An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.

Затронутые продукты
openSUSE Leap 15.0:cinnamon-3.6.7-lp150.3.3.1
openSUSE Leap 15.0:cinnamon-gschemas-3.6.7-lp150.3.3.1
openSUSE Leap 15.0:cinnamon-gschemas-branding-upstream-3.6.7-lp150.3.3.1
Ссылки