Description
Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| UBports | lomiri-download-manager | 0.1.0 – < 0.3.3 | 0.3.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lomiri-download-manager | 0.3.3-1 | — |
| Debian 13 | lomiri-download-manager | No fix yet | — |
| Debian 12 | lomiri-download-manager | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | lomiri-download-manager | No fix yet | — |
| Ubuntu 24.04 LTS | lomiri-download-manager | No fix yet | — |
| Ubuntu 22.04 LTS | lomiri-download-manager | No fix yet | — |
References
- https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18
- https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa
- https://forums.ubports.com/topic/12671/security-advisory-arbitrary-root-command-execution-and-unauthenticated-arbitrary-file-read-as-root-in-lomiri-download-manager