Lucene search

DebianDEBIAN:DLA-1420-1:732D3

HistoryJul 13, 2018 - 8:51 a.m.

[SECURITY] [DLA-1420-1] cinnamon security update

2018-07-1308:51:50

lists.debian.org

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

70.1%

JSON

Package : cinnamon
Version : 2.2.16-5+deb8u1
CVE ID : CVE-2018-13054
Debian Bug : #903201

It was discovered that there was a symlink attack in the Cinnamon
desktop environment.

An attacker could overwrite an arbitrary file on the filesystem via
a $HOME/.face icon file (as the cinnamon-settings-users.py GUI runs
as root).

For Debian 8 "Jessie", this issue has been fixed in cinnamon version
2.2.16-5+deb8u1.

We recommend that you upgrade your cinnamon packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8amd64cinnamon-dbg< 2.2.16-5+deb8u1cinnamon-dbg_2.2.16-5+deb8u1_amd64.deb
Debian8armelcinnamon< 2.2.16-5+deb8u1cinnamon_2.2.16-5+deb8u1_armel.deb
Debian8allcinnamon-common< 2.2.16-5+deb8u1cinnamon-common_2.2.16-5+deb8u1_all.deb
Debian8armhfcinnamon-dbg< 2.2.16-5+deb8u1cinnamon-dbg_2.2.16-5+deb8u1_armhf.deb
Debian8amd64cinnamon< 2.2.16-5+deb8u1cinnamon_2.2.16-5+deb8u1_amd64.deb
Debian8allcinnamon< 2.2.16-5+deb8u1cinnamon_2.2.16-5+deb8u1_all.deb
Debian8i386cinnamon-dbg< 2.2.16-5+deb8u1cinnamon-dbg_2.2.16-5+deb8u1_i386.deb
Debian8armhfcinnamon< 2.2.16-5+deb8u1cinnamon_2.2.16-5+deb8u1_armhf.deb
Debian8armelcinnamon-dbg< 2.2.16-5+deb8u1cinnamon-dbg_2.2.16-5+deb8u1_armel.deb
Debian8i386cinnamon< 2.2.16-5+deb8u1cinnamon_2.2.16-5+deb8u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	cinnamon-dbg	< 2.2.16-5+deb8u1	cinnamon-dbg_2.2.16-5+deb8u1_amd64.deb
Debian	8	armel	cinnamon	< 2.2.16-5+deb8u1	cinnamon_2.2.16-5+deb8u1_armel.deb
Debian	8	all	cinnamon-common	< 2.2.16-5+deb8u1	cinnamon-common_2.2.16-5+deb8u1_all.deb
Debian	8	armhf	cinnamon-dbg	< 2.2.16-5+deb8u1	cinnamon-dbg_2.2.16-5+deb8u1_armhf.deb
Debian	8	amd64	cinnamon	< 2.2.16-5+deb8u1	cinnamon_2.2.16-5+deb8u1_amd64.deb
Debian	8	all	cinnamon	< 2.2.16-5+deb8u1	cinnamon_2.2.16-5+deb8u1_all.deb
Debian	8	i386	cinnamon-dbg	< 2.2.16-5+deb8u1	cinnamon-dbg_2.2.16-5+deb8u1_i386.deb
Debian	8	armhf	cinnamon	< 2.2.16-5+deb8u1	cinnamon_2.2.16-5+deb8u1_armhf.deb
Debian	8	armel	cinnamon-dbg	< 2.2.16-5+deb8u1	cinnamon-dbg_2.2.16-5+deb8u1_armel.deb
Debian	8	i386	cinnamon	< 2.2.16-5+deb8u1	cinnamon_2.2.16-5+deb8u1_i386.deb