dx-packages team mailing list archive

[Margarita Manterola <marga@xxxxxxxxxx>]

As can be seen in http://bazaar.launchpad.net/~unity-
team/unity/5.0/changes/2425?start_revid=2425, the commit was submitted
in revision 2423, but there have been no Unity 5 releases after that.

Is there going to be a last Unity 5 release, or is 5.20 the last one?

-- 
You received this bug notification because you are a member of DX
Packages, which is subscribed to unity in Ubuntu.
Matching subscriptions: dx-packages
https://bugs.launchpad.net/bugs/1051921

Title:
  lens-bar-keynavigation periodically writes to /tmp/wut.png

Status in Unity:
  Fix Released
Status in Unity 5.0 series:
  Fix Released
Status in “unity” package in Ubuntu:
  Fix Released
Status in “unity” source package in Precise:
  Triaged

Bug description:
  [Impact]

   * Style::SquareButton writes a small png to /tmp/wut.png
   * If a user creates /tmp/wut.png as a symlink to some file on the system writeable by the owner of the unity process, then he/she can destroy that file.

  [Test Case]

   * log out
   * log in with the upgraded package
   * open the terminal application using control-alt-T, ensure the terminal is focused
   * invoke the HUD by pressing the Alt key and typing f (the HUD menu selection 'drop
     down' must appear to trigger the png file write)
   * check for presence of "/tmp/wut.png"

  [Regression Potential]

   * n/a

  [Other Info]

   * Marc Deslauriers from the security team said it isn't a problem on
  Ubuntu because we have symlink restrictions (in this case part of the
  Yama LSM [1]).

   * We believe, not everyone is necessarily running Yama LSM.

To manage notifications about this bug go to:
https://bugs.launchpad.net/unity/+bug/1051921/+subscriptions