Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-15131: It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user's files being inadvertently exposed to other local users. 1455094: CVE-2017-15131 xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | xdg-user-dirs | 0:0.15-5.amzn2 |
| Amazon Linux · 2 | xdg-user-dirs-debuginfo | 0:0.15-5.amzn2 |
Vulnerabilities 1
-
Unscored —
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources x…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2017-15131.html