CVE-2013-4459 LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to bypass intended restrictions by leveraging the Guest account.
LowCVSS 3.3
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to bypass intended restrictions by leveraging the Guest account.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| robert ancell lightdm | = 1.7.5 | No fix listed |
| robert ancell lightdm | = 1.7.6 | No fix listed |
| robert ancell lightdm | = 1.7.7 | No fix listed |
| robert ancell lightdm | = 1.7.8 | No fix listed |
| robert ancell lightdm | = 1.7.9 | No fix listed |
| robert ancell lightdm | = 1.7.10 | No fix listed |
| robert ancell lightdm | = 1.7.11 | No fix listed |
| robert ancell lightdm | = 1.7.12 | No fix listed |
| robert ancell lightdm | = 1.7.13 | No fix listed |
| robert ancell lightdm | = 1.7.14 | No fix listed |
| robert ancell lightdm | = 1.7.15 | No fix listed |
| robert ancell lightdm | = 1.7.16 | No fix listed |
| robert ancell lightdm | = 1.7.17 | No fix listed |
| robert ancell lightdm | = 1.7.18 | No fix listed |
| robert ancell lightdm | = 1.8.0 | No fix listed |
| robert ancell lightdm | = 1.8.1 | No fix listed |
| robert ancell lightdm | = 1.8.2 | No fix listed |
| robert ancell lightdm | = 1.8.3 | No fix listed |
| robert ancell lightdm | = 1.9.0 | No fix listed |
| robert ancell lightdm | = 1.9.1 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
References
- [LightDM] 20131030 lightdm 1.9.2 released mailing-list
- [LightDM] 20131031 lightdm 1.8.4 released mailing-list
- USN-2012-1 vendor-advisory
- bugs.launchpad.net exploit
- Debian Security Tracker CVE-2013-4459 vendor-advisory