oss-security - CVE-2015-0856: sddm does not prevent access to the KDE crash handler

Message-ID: <878u751e7h.fsf@mid.deneb.enyo.de>
Date: Wed, 14 Oct 2015 20:45:38 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-0856: sddm does not prevent access to the KDE crash handler

Pavel Avgustinov discovered that sddm does not disable the KDE crash
handler, and certain themes would allow shell access to the sddm user
as a result in case of a crash.

Upstream fix:

https://github.com/sddm/sddm/commit/4cfed6b0a625593fb43876f04badc4dd99799d86

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.