Security update for gdm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0527-1 Final 1 1 2019-03-01T12:03:23Z current 2019-03-01T12:03:23Z 2019-03-01T12:03:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gdm This update for gdm fixes the following issues: Security issue fixed: - CVE-2019-3825: Fixed a lock screen bypass when timed login was enabled (bsc#1124628). Other issues fixed: - GLX applications do not work well when the proprietary nvidia driver is used with a wayland session. Because of that this update disables wayland on that hardware (bsc#1112578). - Fixed an issue where gdm restart fails to kill user processes (bsc#1112294 and bsc#1113245). - Fixed a System halt in the screen with message 'End of ORACLE section' (bsc#1120307). - Fixed an issue which did not allow the returning to text console when gdm is stopped (bsc#1113700). - Fixed an issue which was causing system hang during the load of gdm (bsc#1112578). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-527,SUSE-SLE-Module-Desktop-Applications-15-2019-527,SUSE-SLE-Module-Development-Tools-OBS-15-2019-527 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190527-1/ Link for SUSE-SU-2019:0527-1 https://lists.suse.com/pipermail/sle-security-updates/2019-March/005164.html E-Mail link for SUSE-SU-2019:0527-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1112294 SUSE Bug 1112294 https://bugzilla.suse.com/1112578 SUSE Bug 1112578 https://bugzilla.suse.com/1113245 SUSE Bug 1113245 https://bugzilla.suse.com/1113700 SUSE Bug 1113700 https://bugzilla.suse.com/1120307 SUSE Bug 1120307 https://bugzilla.suse.com/1124628 SUSE Bug 1124628 https://www.suse.com/security/cve/CVE-2019-3825/ SUSE CVE CVE-2019-3825 page SUSE Linux Enterprise Module for Desktop Applications 15 gdm-3.26.2.1-13.19.2 gdm-branding-upstream-3.26.2.1-13.19.2 gdm-devel-3.26.2.1-13.19.2 gdm-lang-3.26.2.1-13.19.2 gdmflexiserver-3.26.2.1-13.19.2 libgdm1-3.26.2.1-13.19.2 typelib-1_0-Gdm-1_0-3.26.2.1-13.19.2 gdm-3.26.2.1-13.19.2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 gdm-devel-3.26.2.1-13.19.2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 gdm-lang-3.26.2.1-13.19.2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 gdmflexiserver-3.26.2.1-13.19.2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libgdm1-3.26.2.1-13.19.2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 typelib-1_0-Gdm-1_0-3.26.2.1-13.19.2 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session. CVE-2019-3825 SUSE Linux Enterprise Module for Desktop Applications 15:gdm-3.26.2.1-13.19.2 SUSE Linux Enterprise Module for Desktop Applications 15:gdm-devel-3.26.2.1-13.19.2 SUSE Linux Enterprise Module for Desktop Applications 15:gdm-lang-3.26.2.1-13.19.2 SUSE Linux Enterprise Module for Desktop Applications 15:gdmflexiserver-3.26.2.1-13.19.2 SUSE Linux Enterprise Module for Desktop Applications 15:libgdm1-3.26.2.1-13.19.2 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-Gdm-1_0-3.26.2.1-13.19.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190527-1/ https://www.suse.com/security/cve/CVE-2019-3825.html CVE-2019-3825 https://bugzilla.suse.com/1124628 SUSE Bug 1124628