Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 496
Alerts This Week
Warning Icon 1 496

SUSE: 2018:3625-1 Moderate: Directory Traversal Issue in Accountsservice

suse
Calendar Grey November 5, 2018
Dist Suse Esm H88
Recent SUSE patch remedies a flaw in accountsservice. For further information, refer to the security implications and installation procedures.
An update that solves one vulnerability and has two fixes is now available

Summary

This update for accountsservice fixes the following issues: This security issue was fixed: - CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699) Thsese non-security issues were fixed: - Don't abort loading users when an /etc/shadow entry is missing. (bsc#1090003) - When user session type is wayland, act_user_is_logged_in can return TRUE if the user is logged in. (bsc#1095918) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Desktop Applications 15: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-2579=1

Topics%20covered

Topics Covered

security advisory moderate security issue software update directory traversal suse accountsservice

References

#1090003 #1095918 #1099699

Cross- CVE-2018-14036

Affected Products:

SUSE Linux Enterprise Module for Desktop Applications 15

https://www.suse.com/security/cve/CVE-2018-14036.html

https://bugzilla.suse.com/1090003

https://bugzilla.suse.com/1095918

https://bugzilla.suse.com/1099699

Announcement ID: SUSE-SU-2018:3625-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate security issue software update directory traversal suse accountsservice

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.