Bug 11093

Summary:	Updated gdm packages fix a security vulnerability (CVE-2020-16125)
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Zombie Ryushu <zombie.ryushu>
Component:	Packages from Main	Assignee:	ROSA Linux Bugs <bugs>
Status:	CONFIRMED ---	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	alzim, andrey.bondrov, denis.silakov, mc2374
Version:	KDE4
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	https://advisories.mageia.org/MGASA-2021-0003.html
Whiteboard:
Platform:	2016.1	ROSA Vulnerability identifier:	CVE-2020-16125
RPM Package:	gdm-3.32.0-1.1.mga7	ISO-related:
Bad POT generating:		Upstream:

Description Zombie Ryushu 2021-01-06 12:29:45 MSK

Kevin Backhouse discovered that GDM incorrectly launched the initial setup tool
when the accountsservice daemon was not reachable. A local attacker able to
cause accountsservice to crash or stop responding could trick GDM into
launching the initial setup tool and create a privileged user (CVE-2020-16125).