FEDORA-2017-6950ea5d05

security update in Fedora 25 for lxterminal, menu-cache, & 1 more

Status: stable 2 years ago

A potential security flaw is found on LXDE products, which create socket under /tmp with some predictable names, which may leads to DOS. The security flow on lxterminal is now assigned as CVE-2016-10369. Some other components also had similar issues.
These new rpms should fix these issues.

At least relogin is required to make this fix effect.

Logout Required

After installing this update it is required that you logout of your current user session and log back in to ensure the changes supplied by this update are applied properly.

Comments 7

This update has been submitted for testing by mtasaka.

works for me

karma: +1 critpath: +1

This update has been pushed to testing.

no regressions noted

karma: +1

This update has been submitted for stable by bodhi.

mtasaka edited this update.

This update has been pushed to stable.

Add Comment & Feedback

Please login to add feedback.

Content Type
RPM
Status
stable
Test Gating
Submitted by
Update Type
security
Update Severity
medium
Karma
+2
stable threshold: 2
unstable threshold: -30
Autopush (karma)
Enabled
Autopush (time)
Disabled
Dates
submitted 2 years ago
in testing 2 years ago
in stable 2 years ago
modified 2 years ago

Related Bugs 3

00 #1449114 CVE-2016-10369 lxterminal: Insecure use of /tmp for a socket file [fedora-all]
00 #1451065 CVE-2017-8934 pcmanfm: Insecure temporary file creation in get_socket_name function [fedora-all]
00 #1451070 CVE-2017-8933 menu-cache: Insecure temporary file creation in get_socket_name function [fedora-all]

Automated Test Results