Arch Linux Security Advisory ASA-201903-3 ========================================= Severity: High Date : 2019-03-03 CVE-ID : CVE-2019-3820 CVE-2019-3825 Package : gdm Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-879 Summary ======= The package gdm before version 3.30.3-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 3.30.3-1. # pacman -Syu "gdm>=3.30.3-1" The problems have been fixed upstream in version 3.30.3. Workaround ========== None. Description =========== - CVE-2019-3820 (access restriction bypass) A partial screen lock bypass via keybindings has been found in gdm <= 3.30.2, allowing a local attacker to unlock a session under certain circumstances. - CVE-2019-3825 (access restriction bypass) An issue has been found in gdm <= 3.30.2, allowing a local attacker with valid credentials to unlock the session for a different user than their own. Impact ====== A local attacker can unlock session if they have other valid credentials, or under certain circumstances. References ========== https://gitlab.gnome.org/GNOME/gnome-shell/issues/851 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825 https://gitlab.gnome.org/GNOME/gdm/issues/460 https://security.archlinux.org/CVE-2019-3820 https://security.archlinux.org/CVE-2019-3825