gdm, gnome security update

2017-08-2401:37:12

CentOS Project

lists.centos.org

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

26.7%

JSON

CentOS Errata and Security Advisory CESA-2017:2128

The GNOME Display Manager (GDM) provides the graphical login screen shown shortly after boot up, log out, and when user-switching.

The following packages have been upgraded to a later upstream version: gdm (3.22.3), gnome-session (3.22.3). (BZ#1386862, BZ#1386957)

Security Fix(es):

It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is locked, possibly bypassing the locked screen. (CVE-2015-7496)

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2017-August/030395.html
https://lists.centos.org/pipermail/centos-cr-announce/2017-August/030434.html

Affected packages:
gdm
gdm-devel
gnome-session
gnome-session-custom-session
gnome-session-xsession

Upstream details at:
https://access.redhat.com/errata/RHSA-2017:2128

OSVersionArchitecturePackageVersionFilename
CentOS7i686gdm< 3.22.3-11.el7gdm-3.22.3-11.el7.i686.rpm
CentOS7x86_64gdm< 3.22.3-11.el7gdm-3.22.3-11.el7.x86_64.rpm
CentOS7i686gdm-devel< 3.22.3-11.el7gdm-devel-3.22.3-11.el7.i686.rpm
CentOS7x86_64gdm-devel< 3.22.3-11.el7gdm-devel-3.22.3-11.el7.x86_64.rpm
CentOS7x86_64gnome-session< 3.22.3-4.el7gnome-session-3.22.3-4.el7.x86_64.rpm
CentOS7x86_64gnome-session-custom-session< 3.22.3-4.el7gnome-session-custom-session-3.22.3-4.el7.x86_64.rpm
CentOS7x86_64gnome-session-xsession< 3.22.3-4.el7gnome-session-xsession-3.22.3-4.el7.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	7	i686	gdm	< 3.22.3-11.el7	gdm-3.22.3-11.el7.i686.rpm
CentOS	7	x86_64	gdm	< 3.22.3-11.el7	gdm-3.22.3-11.el7.x86_64.rpm
CentOS	7	i686	gdm-devel	< 3.22.3-11.el7	gdm-devel-3.22.3-11.el7.i686.rpm
CentOS	7	x86_64	gdm-devel	< 3.22.3-11.el7	gdm-devel-3.22.3-11.el7.x86_64.rpm
CentOS	7	x86_64	gnome-session	< 3.22.3-4.el7	gnome-session-3.22.3-4.el7.x86_64.rpm
CentOS	7	x86_64	gnome-session-custom-session	< 3.22.3-4.el7	gnome-session-custom-session-3.22.3-4.el7.x86_64.rpm
CentOS	7	x86_64	gnome-session-xsession	< 3.22.3-4.el7	gnome-session-xsession-3.22.3-4.el7.x86_64.rpm