** Description changed: [ Impact ] This is a new bugfix release for gdm: https://download.gnome.org/sources/gdm/50/gdm-50.3.news 50.3 ==== * Fixed pam_gdm regression where a previous security fix caused authentication - to fail on systemd, which intentionally leaves the kernel keyring buffer - unterminated [Adrian; !391] + to fail on systemd, which intentionally leaves the kernel keyring buffer + unterminated [Adrian; !391] * Fixed potential use-after-free where gdm-session-settings did not keep a - reference to the user, which could be freed by the manager while it was - still emitting signals [Ignacio; !392] + reference to the user, which could be freed by the manager while it was + still emitting signals [Ignacio; !392] * Fixed connection reference leaks and a use-after-free crash in session - worker connection teardown that could bring down the whole user session - during screen lock/unlock [pozsy; !385] + worker connection teardown that could bring down the whole user session + during screen lock/unlock [pozsy; !385] * Translation updates Contributors: - Adrian Vovk, Ignacio Casal Quinteiro, Nathan Follens, pozsy + Adrian Vovk, Ignacio Casal Quinteiro, Nathan Follens, pozsy + + 50.2 + ==== + + * Fixed path traversal vulnerability where a compromised greeter could load + arbitrary .desktop files via SelectSession, potentially executing + attacker-controlled commands as the authenticated user [Mario; !377] + * Fixed autologin bypass where a compromised greeter could request autologin + for any local account by sending arbitrary usernames via BeginAutoLogin + [Mario; !375] + * Fixed denial of service where an invalid session name from the greeter would + cause the entire daemon to exit, terminating all active sessions [Mario; !376] + * Fixed passphrase handling in pam_gdm to wipe cached plaintext passwords + before freeing and to bound the keyring buffer walk preventing out-of-bounds + reads [Mario; !384] + * Fixed crashes, memory leaks and wrong hash key type in reauthentication + channel handler, session worker and dynamic user store [Ignacio; !371] + * Translation updates + + Contributors: + Christian Kirbach, Ignacio Casal Quinteiro, Mario Limonciello, + Victoria Niedzielska [ Test Plan ] Perform the test plan documented in the Ubuntu project documentation: https://ubuntu.com/project/docs/maintainers/test-plans/desktop-team/GDM/ [ Where problems could occur ] GDM provides the log-in screen for Ubuntu Desktop. It also provides the hand-off to the first-boot wizard for pre-installed images. Problems could manifest in those scenarios. + + [ Other info ] + + gdm is part of the GNOME MRE: + https://ubuntu.com/project/docs/SRU/reference/exception-GNOME-Updates/
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2173380 Title: [SRU] GDM 50.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/2173380/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
