Bug 17210 - lightdm new security issue CVE-2015-8316
Summary: lightdm new security issue CVE-2015-8316
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/666130/
Whiteboard: has_procedure MGA5-64-OK MGA5-32-OK a...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-11-23 20:23 CET by David Walser
Modified: 2015-11-30 18:58 CET (History)
5 users (show)

See Also:
Source RPM: lightdm-1.14.2-1.mga5.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2015-11-23 20:23:58 CET 
A CVE was assigned for a denial of service issue in lightdm:
http://openwall.com/lists/oss-security/2015/11/22/1

The issue is fixed upstream in 1.14.4 and 1.16.6 (already in Cauldron).

Reproducible: 

Steps to Reproduce:
Comment 1 Jani Välimaa 2015-11-23 21:12:46 CET 
Pushed 1.14.4 to mga5 core/updates_testing:

SRPM:
lightdm-1.14.4-1.mga5

RPMS:
lightdm-1.14.4-1.mga5
lib(|64)lightdm-gobject1_0-1.14.4-1.mga5
lib(|64)lightdm-gir1-1.14.4-1.mga5
lib(|64)lightdm-gobject-devel-1.14.4-1.mga5
lib(|64)lightdm-qt5_3_0-1.14.4-1.mga5
lib(|64)lightdm-qt5-devel-1.14.4-1.mga5
lib(|64)lightdm-qt3_0-1.14.4-1.mga5
lib(|64)lightdm-qt-devel-1.14.4-1.mga5

Will provide advisory later when I've more time and if no-one hasn't provided it before me.

CC: (none) => jani.valimaa
Assignee: jani.valimaa => qa-bugs

Comment 2 Shlomi Fish 2015-11-26 22:02:59 CET 
lightdm after the updates is working fine on Mageia Linux x86-64 v5. On my Acer Laptop. I Was able to reboot to it and log in (after setting it up as the display manager on MCC). Would testing MGA5-32 be adequate if tested in VBox or KVM?

CC: (none) => shlomif
Whiteboard: (none) => MGA5-64-OK

Comment 3 Herman Viaene 2015-11-27 10:24:58 CET 
MGA5-32 on Acer D620 Xfce
No installation issues
Works fine.

CC: (none) => herman.viaene
Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK

Comment 4 claire robinson 2015-11-27 11:59:32 CET 
Validating. Thanks.

Keywords: (none) => validated_update
Whiteboard: MGA5-64-OK MGA5-32-OK => has_procedure MGA5-64-OK MGA5-32-OK
CC: (none) => sysadmin-bugs

Dave Hodgins 2015-11-27 22:48:19 CET

CC: (none) => davidwhodgins
Whiteboard: has_procedure MGA5-64-OK MGA5-32-OK => has_procedure MGA5-64-OK MGA5-32-OK advisory

Comment 5 Mageia Robot 2015-11-28 00:12:04 CET 
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0461.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2015-11-30 18:58:24 CET

URL: (none) => http://lwn.net/Vulnerabilities/666130/
Note You need to log in before you can comment on or make changes to this bug.