CVE-2018-14345

An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and...

CVE-2014-7271

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to log in as user "sddm" without authentication...

Authentication flaw

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to log in as user "sddm" without authentication...

Race condition

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance exploitation requires the user to win a race condition in the...

CVE-2014-7272

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance exploitation requires the user to win a race condition in the...

CVE-2014-7271

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to log in as user "sddm" without authentication...

CVE-2014-7271

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to log in as user "sddm" without authentication...

CVE-2014-7271

CVE-2014-7271 affects Simple Desktop Display Manager (SDDM). It describes an authentication flaw where versions prior to 0.10.0 allow local users to log in as the user "sddm" without authentication. Impact is local access and credential-free logins for that account. Mitigation: upgrade to SDDM 0....

CVE-2014-7272

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance exploitation requires the user to win a race condition in the...

CVE-2014-7272

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance exploitation requires the user to win a race condition in the...

CVE-2014-7271

Simple Desktop Display Manager SDDM before 0.10.0 allows local users to log in as user "sddm" without authentication...

CVE-2014-7272

CVE-2014-7272 affects Simple Desktop Display Manager (SDDM) prior to 0.10.0. The vulnerability arises when code running as root writes in a user’s home directory and a race condition in the ~/.Xauthority chown case can be exploited by a user who created links in advance. This can allow local user...

Debian DSA-4116-1 : plasma-workspace - security update

Krzysztof Sieluzycki discovered that the notifier for removable devices in the KDE Plasma workspace performed insufficient sanitisation of FAT/VFAT volume labels, which could result in the execution of arbitrary shell commands if a removable device with a malformed disk label is mounted. C Tenabl...

Fedora 23 : sddm-0.12.0-5.fc23 (2015-b15b90eeaa)

sddm-0.12.0-5.fc23 - Security fix for CVE-2015-0856 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 22 : sddm-0.12.0-5.fc22 (2015-9f996ea146)

sddm-0.12.0-5.fc22 - Security fix for CVE-2015-0856 ---- Refresh to latest stable upstream release, see: https://github.com/sddm/sddm/wiki/0.12.0 -Release-Announcement Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory...

CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

Code injection

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...

CVE-2015-0856

daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme...