PT-2014-3992 · Canonical · Lightdm Gtk+ Greeter

Gber + 1 · Publicado 2014-01-23 · Atualizado 2018-10-30 · CVE-2014-0979

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions LightDM GTK+ Greeter versions prior to 1.7.1

Description The issue arises from the start authentication function in lightdm-gtk-greeter.c, which fails to handle the return value from the lightdm greeter get authentication user function correctly. This allows local users to cause a denial of service, specifically a NULL pointer dereference, by providing an empty username.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 or later to resolve the issue. As a temporary workaround, consider validating user input to prevent empty usernames from being processed by the start authentication function.

Correção

Identificadores relacionados

CVE-2014-0979

MGASA-2014-0026

Produtos afetados

Lightdm Gtk+ Greeter

Referências · 20

• http://openwall.com/lists/oss-security/2014/01/07/15 · Nota
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00048.html · Aviso do Fabricante
• https://bugzilla.novell.com/show_bug.cgi?id=857303 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0979 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/01/07/5 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0979 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128117.html · Aviso do Fabricante
• http://secunia.com/advisories/56211 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128150.html · Aviso do Fabricante
• https://bugs.launchpad.net/lightdm-gtk-greeter/+bug/1266449 · Nota
• http://secunia.com/advisories/56423 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0026.html · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2014-0979 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-0979 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0979 · Nota de Segurança