[Bug 1225774] New: VUL-0: CVE-2024-36041: ksmserver: Unauthorized users can access session manager
https://bugzilla.suse.com/show_bug.cgi?id=1225774 Bug ID: 1225774 Summary: VUL-0: CVE-2024-36041: ksmserver: Unauthorized users can access session manager Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: fabian@ritter-vogt.de Reporter: fabian@ritter-vogt.de QA Contact: qa-bugs@suse.de CC: security-team@suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2024-36041 https://kde.org/info/security/advisory-20240531-1.txt Needs two patches added to plasma5-workspace in 15.5 + 15.6 as well as plasma6-workspace in Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225774 https://bugzilla.suse.com/show_bug.cgi?id=1225774#c1 Fabian Vogt <fabian@ritter-vogt.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|fabian@ritter-vogt.de |security-team@suse.de CC| |fabian@ritter-vogt.de Status|NEW |IN_PROGRESS --- Comment #1 from Fabian Vogt <fabian@ritter-vogt.de> --- Submissions: TW: https://build.opensuse.org/request/show/1177981 15.5: https://build.opensuse.org/request/show/1177980 wants a review from backports for some reason? 15.6: https://build.opensuse.org/request/show/1177979 apparently the :Update project isn't set up yet? -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225774 Fabian Vogt <fabian@ritter-vogt.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |opensuse-kde-bugs@opensuse. | |org -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225774 https://bugzilla.suse.com/show_bug.cgi?id=1225774#c3 --- Comment #3 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1225774) was mentioned in https://build.opensuse.org/request/show/1178248 Backports:SLE-15-SP6 / plasma5-workspace -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225774 https://bugzilla.suse.com/show_bug.cgi?id=1225774#c5 --- Comment #5 from Andreas Schwab <schwab@linux-m68k.org> --- This completely breaks session management. It is no longer possible to restore a session at login, neither the current session nor a manually saved one. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225774 https://bugzilla.suse.com/show_bug.cgi?id=1225774#c6 --- Comment #6 from Fabian Vogt <fabian@ritter-vogt.de> --- (In reply to Andreas Schwab from comment #5)
This completely breaks session management. It is no longer possible to restore a session at login, neither the current session nor a manually saved one.
More details are needed there. I suspect it's because the $ICEAUTHORITY variable is not set properly or the authority file is inaccessible. Please file a new bug report though, this is only about the security issue. -- You are receiving this mail because: You are on the CC list for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1225774 https://bugzilla.suse.com/show_bug.cgi?id=1225774#c7 --- Comment #7 from OBSbugzilla Bot <bwiedemann+obsbugzillabot@suse.com> --- This is an autogenerated message for OBS integration: This bug (1225774) was mentioned in https://build.opensuse.org/request/show/1179708 Backports:SLE-15-SP6 / plasma5-workspace -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠suse.com