*** This bug is a security vulnerability *** Public security bug reported:
lomiri-download-manager 0.3.3 includes 2 security fixes. A CVE has not been assigned yet. The security issues can be summarized as - arbitrary root command execution - unathenticated file access Testing Done ------------ I successfully built lomiri-download-manager with the attached debdiff on Ubuntu 26.04 LTS and installed it onto Ubuntu 26.04 LTS running the Lomiri desktop. Once I had lomiri-upload-manager installed and then logged out and logged back in, I verified that I could use the poc.py from #18 to gain access to a file I shouldn't have. After installing the update and logging out and logging back in, I was unable to use poc.py to access that file. I verified the first command of the #17 proof of concept worked. After installing the update and logging out and logging back in, that proof of concept no longer worked. #17 has a second command that I wasn't able to get working. Other Info ---------- The original bug reports are here, but are not yet public: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/17 https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18 lomiri-upload-manager's only reverse dependency in Ubuntu is nuntium which itself has no reverse dependencies so it's unlikely for that component to be pre-installed. However the #17 proof of concept doesn't need lomiri-upload-manager. There is not yet an official or unofficial Ubuntu desktop flavor for Lomiri. ** Affects: lomiri-download-manager (Ubuntu) Importance: Undecided Status: Confirmed ** Description changed: lomiri-download-manager 0.3.3 includes 2 security fixes. A CVE has not been assigned yet. The security issues can be summarized as - arbitrary root command execution - unathenticated file access Testing Done ------------ I successfully built lomiri-download-manager with the attached debdiff on Ubuntu 26.04 LTS and installed it onto Ubuntu 26.04 LTS running the Lomiri desktop. Once I had lomiri-upload-manager installed and then logged out and logged back in, I verified that I could use the poc.py from #18 to gain access to a file I shouldn't have. After installing the update and logging out and logging back in, I was unable to use poc.py to access that file. I verified the first command of the #17 proof of concept worked. After installing the update and logging out and logging back in, that proof of concept no longer worked. #17 has a second command that I wasn't able to get working. Other Info ---------- The original bug reports are here, but are not yet public: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/17 https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18 lomiri-upload-manager's only reverse dependency in Ubuntu is nuntium which itself has no reverse dependencies so it's unlikely for that component to be pre-installed. However the #17 proof of concept doesn't need lomiri-upload-manager. + + There is not yet an official or unofficial Ubuntu desktop flavor for + Lomiri. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167356 Title: September 2026 security update To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lomiri-download-manager/+bug/2167356/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
