CVE-2017-15131 – gnome-session: Xsession creation of XDG user directories does not honor system umask policy

https://notcve.org/view.php?id=CVE-2017-15131

It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux. Se ha descubierto que no se respeta la política system umask cuando se crean directorios de usuarios XDG, ya que Xsession obtiene xdg-user-dirs.sh antes de establecer la política umask. Esto solo afecta a xdg-user-dirs en versiones anteriores a la 0.15.5, tal y como se incluye en Red Hat Enterprise Linux. It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. • https://access.redhat.com/errata/RHSA-2018:0842 https://bugzilla.redhat.com/show_bug.cgi?id=1412762 https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E https://access.redhat.com/security/cve/CVE-2017-15131 https://bugzilla.redhat.com/show_bug.cgi?id=1455094 • CWE-266: Incorrect Privilege Assignment CWE-276: Incorrect Default Permissions CWE-284: Improper Access Control •