openSUSE Security Update: KDE KDM local root exploit (CVE-2010-0436) ______________________________________________________________________________ Announcement ID: openSUSE-SU-2010:0112-1 Rating: important References: #584223 Cross-References: CVE-2010-0436 Affected Products: openSUSE 11.2 openSUSE 11.1 openSUSE 11.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The KDE KDM contains a local race condition which allows to make arbitrary files world writable. CVE-2010-0436 has been assigned to this issue. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.2: zypper in -t patch kde4-kdm-2134 - openSUSE 11.1: zypper in -t patch fileshareset-2204 kde4-kdm-2134 - openSUSE 11.0: zypper in -t patch fileshareset-2204 kde4-kdm-2134 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.2 (i586 src x86_64) [New Version: 4.3.5]: kdebase4-workspace-4.3.5-0.3.1 - openSUSE 11.2 (i586 x86_64) [New Version: 4.3.5]: kde4-kgreeter-plugins-4.3.5-0.3.1 kdebase4-workspace-branding-upstream-4.3.5-0.3.1 kdebase4-workspace-devel-4.3.5-0.3.1 kdebase4-workspace-google-gadgets-4.3.5-0.3.1 kdebase4-workspace-ksysguardd-4.3.5-0.3.1 kdm-4.3.5-0.3.1 kdm-branding-upstream-4.3.5-0.3.1 kwin-4.3.5-0.3.1 - openSUSE 11.1 (i586 ppc src x86_64): kdebase3-3.5.10-17.5.1 kdebase4-workspace-4.1.3-10.4.1 - openSUSE 11.1 (i586 ppc x86_64): fileshareset-2.0-17.5.1 kde4-kdm-4.1.3-10.4.1 kde4-kdm-branding-upstream-4.1.3-10.4.1 kde4-kgreeter-plugins-4.1.3-10.4.1 kde4-kwin-4.1.3-10.4.1 kdebase3-beagle-3.5.10-17.5.1 kdebase3-devel-3.5.10-17.5.1 kdebase3-extra-3.5.10-17.5.1 kdebase3-kdm-3.5.10-17.5.1 kdebase3-nsplugin-3.5.10-17.5.1 kdebase3-runtime-3.5.10-17.5.1 kdebase3-samba-3.5.10-17.5.1 kdebase3-session-3.5.10-17.5.1 kdebase4-workspace-branding-upstream-4.1.3-10.4.1 kdebase4-workspace-devel-4.1.3-10.4.1 kdebase4-workspace-ksysguardd-4.1.3-10.4.1 misc-console-font-3.5.10-17.5.1 - openSUSE 11.1 (x86_64): kdebase3-32bit-3.5.10-17.5.1 kdebase3-runtime-32bit-3.5.10-17.5.1 - openSUSE 11.0 (i586 ppc src x86_64): kdebase3-3.5.9-65.4 kdebase4-workspace-4.0.4-24.8 - openSUSE 11.0 (i586 ppc x86_64): fileshareset-2.0-501.4 kde4-kdm-4.0.4-24.8 kde4-kdm-branding-upstream-4.0.4-24.8 kde4-kwin-4.0.4-24.8 kdebase3-beagle-3.5.9-65.4 kdebase3-devel-3.5.9-65.4 kdebase3-extra-3.5.9-65.4 kdebase3-kdm-3.5.9-65.4 kdebase3-runtime-3.5.9-65.4 kdebase3-samba-3.5.9-65.4 kdebase3-session-3.5.9-65.4 kdebase4-workspace-branding-upstream-4.0.4-24.8 kdebase4-workspace-devel-4.0.4-24.8 kdebase4-workspace-ksysguardd-4.0.4-24.8 misc-console-font-3.5.9-65.4 - openSUSE 11.0 (i586 ppc): kdebase3-nsplugin-3.5.9-65.4 - openSUSE 11.0 (x86_64): kdebase3-32bit-3.5.9-65.4 kdebase3-runtime-32bit-3.5.9-65.4 - openSUSE 11.0 (ppc): kdebase3-64bit-3.5.9-65.4 kdebase3-runtime-64bit-3.5.9-65.4 References: http://support.novell.com/security/cve/CVE-2010-0436.html https://bugzilla.novell.com/584223