PT-2018-12505 · Alt Linux Team+4 · Alt Linux+3

Chris Coulson · Publicado 2018-08-13 · Atualizado 2024-06-15 · CVE-2018-14424

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GDM versions prior to 3.29.1 ALT Linux (affected versions not specified)

Description The issue arises from the daemon in GDM not properly unexporting display objects from its D-Bus interface when they are destroyed. This allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls. As a result, this can lead to a denial of service or potential code execution.

Recommendations For GDM versions prior to 3.29.1, update to version 3.29.1 or later to resolve the issue. At the moment, there is no information about a fix for ALT Linux.

Correção

DoS

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2018-2142

ALT-PU-2018-2309

CVE-2018-14424

DLA-1494-1

DSA-4270-1

OPENSUSE-SU-2018_2818-1

OPENSUSE-SU-2024:10780-1

SUSE-SU-2018:2527-1

SUSE-SU-2018:2771-1

SUSE-SU-2018_2527-1

SUSE-SU-2018_2771-1

USN-3737-1

Produtos afetados

Alt Linux

Gdm

Suse

Ubuntu

Referências · 40

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14424 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-3737-1 · Aviso do Fabricante
• https://lists.suse.com/pipermail/sle-security-updates/2018-September/004570.html · Nota
• https://usn.ubuntu.com/3737-1 · Aviso do Fabricante
• https://packages.debian.org/src:gdm3 · Nota
• https://ubuntu.com/security/CVE-2018-14424 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4270-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10780-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-14424 · Nota
• https://suse.com/security/cve/CVE-2019-3825 · Nota
• https://gitlab.gnome.org/GNOME/gdm/issues/401 · Nota
• https://cve.org/CVERecord?id=CVE-2018-14424 · Nota de Segurança
• https://bugzilla.suse.com/1103093 · Nota
• https://errata.altlinux.org/ALT-PU-2018-2309 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DLA-1494-1 · Aviso do Fabricante