CVE-2018-13054

NameCVE-2018-13054
DescriptionAn issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1420-1
Debian Bugs903201

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cinnamon (PTS)jessie2.2.16-5vulnerable
jessie (security)2.2.16-5+deb8u1fixed
stretch3.2.7-4vulnerable
buster, sid3.6.7-8vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cinnamonsource(unstable)(unfixed)903201
cinnamonsourcejessie2.2.16-5+deb8u1DLA-1420-1

Notes

[stretch] - cinnamon <no-dsa> (Minor issue)
https://github.com/linuxmint/Cinnamon/pull/7683
https://github.com/linuxmint/Cinnamon/commit/66e54f43f179fdf041a3e5232178a9910963cfb5
https://bugzilla.suse.com/show_bug.cgi?id=1083067

Search for package or bug name: Reporting problems