[ASA-202011-5] gdm: privilege escalation
rgacogne at archlinux.org
Tue Nov 10 21:18:50 UTC 2020
Arch Linux Security Advisory ASA-202011-5
Date : 2020-11-10
CVE-ID : CVE-2020-16125
Package : gdm
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-1264
The package gdm before version 3.38.2-1 is vulnerable to privilege
Upgrade to 3.38.2-1.
# pacman -Syu "gdm>=3.38.2-1"
The problem has been fixed upstream in version 3.38.2.
gdm before 3.38.2 can be tricked into launching gnome-initial-setup,
enabling an unprivileged user to create a new user account for
themselves. The new account is a member of the sudo group, so this
enables the unprivileged user to obtain admin privileges.
An unprivileged local user might be able to elevate privileges to root.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security