CVE-2013-4331

Publication date 12 September 2013

Last updated 24 July 2024

Ubuntu priority

Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
lightdm	13.04 raring	Fixed 1.6.0-0ubuntu3.1
	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

How can I get the fixes?
What do statuses mean?
Patch details

Notes

mdeslaur

couldn't reproduce on quantal

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
lightdm	Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1571 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1576 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1577 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1641 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1652 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1653 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1675 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1780 Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1781

Package

Patch details

lightdm

Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1571
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1576
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.4/revision/1577
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1641
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1652
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/1.6/revision/1653
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1675
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1780
Upstream: http://bazaar.launchpad.net/~lightdm-team/lightdm/trunk/revision/1781

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-1950-1
Light Display Manager vulnerability
12 September 2013

Other references

https://www.cve.org/CVERecord?id=CVE-2013-4331