Permissions, Privileges, and Access Controls in Fedora - CVE-2015-7496

Vulnerability identifier: #VU40591

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-7496

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.

Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server for ARM
gdm
gnome-session (Red Hat package)
gdm (Red Hat package)

Install update from vendor's website.

gdm - update to 3.18.2-1.fc23
gnome-session (Red Hat package) - update to 3.22.3-4.el7
gdm (Red Hat package) - update to 3.22.3-11.el7

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172328.html
• http://www.openwall.com/lists/oss-security/2015/11/17/10
• http://www.openwall.com/lists/oss-security/2015/11/17/8
• https://access.redhat.com/errata/RHSA-2017:2128
• https://bugzilla.gnome.org/show_bug.cgi?id=758032
• https://download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news

• Permissions, Privileges, and Access Controls in Fedoraproject Fedora
• Fedora 23 update for gdm
• Red Hat Enterprise Linux 7 update for gdm and gnome-session