Security update for gnome-desktop SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3837-1 Final 1 1 2022-11-01T08:00:03Z current 2022-11-01T08:00:03Z 2022-11-01T08:00:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gnome-desktop This update for gnome-desktop fixes the following issues: - CVE-2019-11460: Fixed sandbox issue that allowed bypassing from a compromised thumbnailer (bsc#1133043). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-3837,openSUSE-SLE-15.3-2022-3837,openSUSE-SLE-15.4-2022-3837 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223837-1/ Link for SUSE-SU-2022:3837-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012788.html E-Mail link for SUSE-SU-2022:3837-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1133043 SUSE Bug 1133043 https://www.suse.com/security/cve/CVE-2019-11460/ SUSE CVE CVE-2019-11460 page openSUSE Leap 15.3 openSUSE Leap 15.4 gnome-desktop-lang-3.26.2-150000.4.3.1 gnome-version-3.26.2-150000.4.3.1 libgnome-desktop-3-12-3.26.2-150000.4.3.1 libgnome-desktop-3-12-32bit-3.26.2-150000.4.3.1 libgnome-desktop-3-12-64bit-3.26.2-150000.4.3.1 libgnome-desktop-3-devel-3.26.2-150000.4.3.1 libgnome-desktop-3_0-common-3.26.2-150000.4.3.1 typelib-1_0-GnomeDesktop-3_0-3.26.2-150000.4.3.1 libgnome-desktop-3-12-3.26.2-150000.4.3.1 as a component of openSUSE Leap 15.3 libgnome-desktop-3-12-32bit-3.26.2-150000.4.3.1 as a component of openSUSE Leap 15.3 libgnome-desktop-3-12-3.26.2-150000.4.3.1 as a component of openSUSE Leap 15.4 libgnome-desktop-3-12-32bit-3.26.2-150000.4.3.1 as a component of openSUSE Leap 15.4 An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063. CVE-2019-11460 openSUSE Leap 15.3:libgnome-desktop-3-12-3.26.2-150000.4.3.1 openSUSE Leap 15.3:libgnome-desktop-3-12-32bit-3.26.2-150000.4.3.1 openSUSE Leap 15.4:libgnome-desktop-3-12-3.26.2-150000.4.3.1 openSUSE Leap 15.4:libgnome-desktop-3-12-32bit-3.26.2-150000.4.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223837-1/ https://www.suse.com/security/cve/CVE-2019-11460.html CVE-2019-11460 https://bugzilla.suse.com/1133043 SUSE Bug 1133043