Advisories ยป MGASA-2019-0063

Updated cinnamon packages fix security vulnerability

Publication date: 13 Feb 2019
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-13054


A flaw was found in Cinnamon 1.9.2 through 3.8.6. The GUI runs as root and allows configuration of
(for example) other users' icon files in _on_face_browse_menuitem_activated
and _on_face_menuitem_activated. These icon files are written to the
respective user's $HOME/.face location. If an unprivileged user prepares a
symlink pointing to an arbitrary location, then this location will be
overwritten with the icon content (CVE-2018-13054).