desktop-packages team mailing list archive

Thread
Date

[Bug 1366790] Re: Fix for CVE-2014-1949 (GTK 3.10.x)

To: desktop-packages@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1366790@xxxxxxxxxxxxxxxxxx>
Date: Thu, 15 Jan 2015 14:49:53 -0000
Reply-to: Bug 1366790 <1366790@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

This bug was fixed in the package gtk+3.0 - 3.10.8-0ubuntu1.4

---------------
gtk+3.0 (3.10.8-0ubuntu1.4) trusty-security; urgency=medium

  * debian/patches/no_popup_menu_in_gtk_window.patch
    - Prevents the menu key from opening neverending menus and from taking
      the focus away from the screensaver (LP: #1366790)
 -- Margarita Manterola <marga@xxxxxxxxxx>   Thu, 15 Jan 2015 10:47:19 +0100

** Changed in: gtk+3.0 (Ubuntu Trusty)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to gtk+3.0 in Ubuntu.
https://bugs.launchpad.net/bugs/1366790

Title:
  Fix for CVE-2014-1949 (GTK 3.10.x)

Status in gtk+3.0 package in Ubuntu:
  Fix Released
Status in gtk+3.0 source package in Trusty:
  Fix Released
Status in gtk+3.0 source package in Utopic:
  Fix Released

Bug description:
  [Impact]
  Users running gnome-screensaver or cinnamon-screensaver may get their lock screen bypassed by users pressing the menu key before the password prompt turns up.

  [Testcase]
  Start GNOME or any other desktop running gnome-screensaver.  Open a terminal. Lock the screen.  Before pressing any other key, press the menu key on the keyboard.

  Results:
   * Without this patch: the menu comes up and after that the terminal, being the window that had focus before the lock, receives all keyboard input.  It's very hard to get the input to go to the password field.
   * With this patch: the password prompt comes up and has focus. Any keys pressed go to the password field.

  [Regression potential]
  The patch removes one function from gtk-window (popup-menu) that was only present for a short time.  It's already been removed in the gtk version present in Utopic. It's very unlikely that any other issues will come up because of this.

  [More info]
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759145
  https://bugzilla.redhat.com/show_bug.cgi?id=1064695
  https://mail.gnome.org/archives/commits-list/2014-January/msg03294.html
  https://github.com/linuxmint/cinnamon-screensaver/issues/44

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gtk+3.0/+bug/1366790/+subscriptions