openSUSE Security Update: Security update for cinnamon
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:2125-1
Rating:             moderate
References:         #1083067 
Cross-References:   CVE-2018-13054
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for cinnamon fixes the following issues:

   Security issue fixed:

   - CVE-2018-13054: Fix symlink attack vulnerability (boo#1083067).

   Bug fixes:

   - Update to version 3.4.6 (changes since 3.4.4):
     * osdWindow.js: Always check the theme node on first showing - an
       actor's width isn't necessarily filled if it hasn't been explicitly
       set, causing the first few activations of the OSD to not show an
       accurate level bar.
     * cs_default: Fix an incorrect button label (but preserve translations).
     * main.js: Remove an obsolete Meta enum member reference.
     * workspace.js: Use our normal prototype init method.
     * workspace.js: Initalise WindowClone._zoomStep to 0.
     * slideshow-applet: Fix a translation.
     * cs_themes.py: Create the file "~/.icons/default/index.theme" and set
       the selected cursor theme inside of it. This ensures other (non-gtk)
       applications end up using the same theme (though they are required to
       be restarted for these changes to take effect).
     * keyboard-applet: Applet icon vanishes when moved in edit mode.
     * cinnamon-json-makepot: Add keyword option, change language used by
       xgettext to JavaScript.
     * expoThumbnail: Correct a couple of calls with mismatched argument
       counts.
     * window-list: Set AppMenuButtons unreactive during panel edit mode.
     * panel-launchers: Set PanelAppLaunchers unreactive during panel edit
       mode.
     * windows-quick-list: Fix argument warning.
     * Fix a reference to undefined actor._delegate warning.
     * ui/environment: Handle undefined actors in
       containerClass.prototype.add.
     * ui/cinnamonDBus: Handle null xlet objects in
       CinnamonDBus.highlightXlet.
     * deskletManager: Initialise some variables and remove the variables
       that were initialised, probable typo


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-767=1



Package List:

   - openSUSE Leap 42.3 (x86_64):

      cinnamon-3.4.6-2.3.1
      cinnamon-debuginfo-3.4.6-2.3.1
      cinnamon-debugsource-3.4.6-2.3.1
      cinnamon-gschemas-3.4.6-2.3.1

   - openSUSE Leap 42.3 (noarch):

      cinnamon-gschemas-branding-upstream-3.4.6-2.3.1


References:

   https://www.suse.com/security/cve/CVE-2018-13054.html
   https://bugzilla.suse.com/1083067

--