Re: [BLFS Trac] #23692: gdm-50.2

#23692: gdm-50.2
-------------------------+--------------------------
 Reporter:  Bruce Dubbs  |       Owner:  Bruce Dubbs
     Type:  enhancement  |      Status:  assigned
 Priority:  normal       |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+--------------------------
Comment (by Bruce Dubbs):

 50.2

 * Fixed path traversal vulnerability where a compromised greeter could
 load
   arbitrary .desktop files via SelectSession, potentially executing
   attacker-controlled commands as the authenticated user.
 * Fixed autologin bypass where a compromised greeter could request
 autologin
   for any local account by sending arbitrary usernames via BeginAutoLogin.
 * Fixed denial of service where an invalid session name from the greeter
 would
   cause the entire daemon to exit, terminating all active sessions.
 * Fixed passphrase handling in pam_gdm to wipe cached plaintext passwords
   before freeing and to bound the keyring buffer walk preventing out-of-
 bounds
   reads.
 * Fixed crashes, memory leaks and wrong hash key type in reauthentication
   channel handler, session worker and dynamic user store,
 * Translation updates
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23692#comment:2>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page