CVE-2017-8900

Published: 11 May 2017

LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session.

Priority

CVSS 3 base score: 4.6

Status

Package	Release	Status
lightdm Launchpad, Ubuntu, Debian	Upstream	Needs triage




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was not-affected)

Notes

Author	Note
tyhicks	This issue was introduced when the user session handling moved from upstart to systemd in Ubuntu 16.10.

References

Bugs

https://launchpad.net/bugs/1663157

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading