Security update for gdm SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:0310-1 Final 1 1 2019-03-23T11:13:00Z current 2019-03-23T11:13:00Z 2019-03-23T11:13:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gdm This update for gdm fixes the following issues: Security issue fixed: - CVE-2019-3825: Fixed a lock screen bypass when timed login was enabled (bsc#1124628). Other issues fixed: - GLX applications do not work well when the proprietary nvidia driver is used with a wayland session. Because of that this update disables wayland on that hardware (bsc#1112578). - Fixed an issue where gdm restart fails to kill user processes (bsc#1112294 and bsc#1113245). - Fixed a System halt in the screen with message 'End of ORACLE section' (bsc#1120307). - Fixed an issue which did not allow the returning to text console when gdm is stopped (bsc#1113700). - Fixed an issue which was causing system hang during the load of gdm (bsc#1112578). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-310 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HFWYPRWLWQRK5AIC6KEJAE4KYRW7NG5K/#HFWYPRWLWQRK5AIC6KEJAE4KYRW7NG5K E-Mail link for openSUSE-SU-2019:0310-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1112294 SUSE Bug 1112294 https://bugzilla.suse.com/1112578 SUSE Bug 1112578 https://bugzilla.suse.com/1113245 SUSE Bug 1113245 https://bugzilla.suse.com/1113700 SUSE Bug 1113700 https://bugzilla.suse.com/1120307 SUSE Bug 1120307 https://bugzilla.suse.com/1124628 SUSE Bug 1124628 https://www.suse.com/security/cve/CVE-2019-3825/ SUSE CVE CVE-2019-3825 page openSUSE Leap 15.0 gdm-3.26.2.1-lp150.11.9.1 gdm-branding-upstream-3.26.2.1-lp150.11.9.1 gdm-devel-3.26.2.1-lp150.11.9.1 gdm-lang-3.26.2.1-lp150.11.9.1 gdmflexiserver-3.26.2.1-lp150.11.9.1 libgdm1-3.26.2.1-lp150.11.9.1 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.9.1 gdm-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 gdm-branding-upstream-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 gdm-devel-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 gdm-lang-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 gdmflexiserver-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 libgdm1-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.9.1 as a component of openSUSE Leap 15.0 A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session. CVE-2019-3825 openSUSE Leap 15.0:gdm-3.26.2.1-lp150.11.9.1 openSUSE Leap 15.0:gdm-branding-upstream-3.26.2.1-lp150.11.9.1 openSUSE Leap 15.0:gdm-devel-3.26.2.1-lp150.11.9.1 openSUSE Leap 15.0:gdm-lang-3.26.2.1-lp150.11.9.1 openSUSE Leap 15.0:gdmflexiserver-3.26.2.1-lp150.11.9.1 openSUSE Leap 15.0:libgdm1-3.26.2.1-lp150.11.9.1 openSUSE Leap 15.0:typelib-1_0-Gdm-1_0-3.26.2.1-lp150.11.9.1 moderate 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HFWYPRWLWQRK5AIC6KEJAE4KYRW7NG5K/#HFWYPRWLWQRK5AIC6KEJAE4KYRW7NG5K https://www.suse.com/security/cve/CVE-2019-3825.html CVE-2019-3825 https://bugzilla.suse.com/1124628 SUSE Bug 1124628