CVE-2014-1949: cinnamon-screensaver can be bypassed by pressing Menu key

Debian Bug report logs - #738828
CVE-2014-1949: cinnamon-screensaver can be bypassed by pressing Menu key

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: cinnamon: CVE-2014-1949

Date: Thu, 13 Feb 2014 10:47:42 +0100

Package: cinnamon
Severity: grave
Tags: security
Justification: user security hole

This was assigned CVE-2014-1949:
http://www.openwall.com/lists/oss-security/2014/02/12/7

Cheers,
        Moritz

Message #10 received at 738828@bugs.debian.org (full text, mbox, reply):

From: Laurento Frittella <laurento.frittella@gmail.com>

To: 738828@bugs.debian.org

Date: Wed, 14 May 2014 19:46:10 +0200

Here is the related upstream bug report on github:
https://github.com/linuxmint/cinnamon-screensaver/issues/44

Cheers,
Laurento

Message #17 received at 738828@bugs.debian.org (full text, mbox, reply):

From: Fabio Fantoni <fantonifabio@tiscali.it>

To: 738828@bugs.debian.org

Cc: lars.cebu@googlemail.com

Subject: cinnamon: CVE-2014-1949

Date: Sat, 19 Jul 2014 18:33:20 +0200

[Message part 1 (text/plain, inline)]

Today I spoken in upstream's devel chat about it, this bug is still
present even if not always reproducible.
Affect older cinnamon's debian package and new cinnamon-screensaver.
One user have posted a "bad and probably partial" fix:
https://github.com/RavetcoFX/cinnamon-screensaver/commit/89150d21004faf63722e6c47af639071de42c6e6
I have some doubts on how to go about it, experts debian's developerscan
give me some advices please?

Thanks for any reply and sorry for my bad english.

[smime.p7s (application/pkcs7-signature, attachment)]

Message #22 received at 738828@bugs.debian.org (full text, mbox, reply):

From: Maximiliano Curia <maxy@debian.org>

To: fantonifabio@tiscali.it, 738828@bugs.debian.org

Cc: lars.cebu@googlemail.com

Subject: Re: [pkg-cinnamon] Bug#738828: cinnamon: CVE-2014-1949

Date: Sun, 20 Jul 2014 00:23:27 +0200

[Message part 1 (text/plain, inline)]

¡Hola Fabio!

El 2014-07-19 a las 18:33 +0200, Fabio Fantoni escribió:
> Today I spoken in upstream's devel chat about it, this bug is still
> present even if not always reproducible.
> Affect older cinnamon's debian package and new cinnamon-screensaver.
> One user have posted a "bad and probably partial" fix:
> https://github.com/RavetcoFX/cinnamon-screensaver/commit/89150d21004faf63722e6c47af639071de42c6e6
> I have some doubts on how to go about it, experts debian's developerscan
> give me some advices please?

After a while checking the issue, we could reproduce the issue installing the
gtk 3.10 and it's solved with gtk 3.12.

Using the packages from snapshots, the problem is reproduceable with gtk
3.10.7 and is fixed in 3.11.5. We haven't yet found the exact fix.

Happy hacking,
-- 
"We must be very careful when we give advice to younger people: sometimes they
follow it!"
-- Edsger W. Dijkstra
Saludos /\/\ /\ >< `/

[signature.asc (application/pgp-signature, inline)]

Message #27 received at 738828@bugs.debian.org (full text, mbox, reply):

From: Margarita Manterola <marga@debian.org>

To: control@bugs.debian.org

Cc: 738828@bugs.debian.org

Subject: Cleaning up

Date: Sat, 26 Jul 2014 16:24:47 +0200

retitle 738828 CVE-2014-1949: cinnamon-screensaver can be bypassed by pressing Menu key
reassign 738828 libgtk-3-0 3.10.7-1
fixed 738828 libgtk-3-0 3.11.8-1
thanks

So, as mentioned in the previous update, this bug only triggers with GTK 3.10,
and is already fixed in 3.11.8. The amount of differences between one and the
other are quite a lot, and therefore finding the exact fix (needed for Ubuntu
Trusty, not for Debian Jessie) is not simple.

But since this bug can be fixed by changing the GTK version, and 3.12 is already
available in Debian, I'm reassigning as closing here.

-- 
Regards,
Marga

Message #40 received at 738828-done@bugs.debian.org (full text, mbox, reply):

From: Margarita Manterola <marga@debian.org>

To: 738828-done@bugs.debian.org

Subject: Correctly closing now

Date: Sat, 26 Jul 2014 22:57:09 +0200

Version: 3.11.8-1

Re-closing, my previous update was intended to close this bug, but it didn't
because of a syntax error.

The bug is fixed with libgtk versions 3.11.8-1 and upper.

-- 
Regards,
Marga

Send a report that this bug log contains spam.