Description
The Ubuntu Date and Time Indicator (aka indicator-datetime) 13.10.0+13.10.x before 13.10.0+13.10.20131023.2-0ubuntu1.1 does not properly restrict access to Evolution, which allows local users to bypass the greeter screen restrictions by clicking the date.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | indicator-datetime | 13.10.0+14.04.20131125-0ubuntu1 | — |
References
- https://bugs.launchpad.net/ubuntu/%2Bsource/indicator-datetime/%2Bbug/1246812
- USN-2186-1 vendor-advisory
- [oss-security] 20140429 CVE Request: indicator-datetime issue mailing-list
- [oss-security] 20140430 Re: CVE Request: indicator-datetime issue mailing-list
- http://bazaar.launchpad.net/~indicator-applet-developers/indicator-datetime/trunk.13.10/revision/282