{"id":"MGASA-2019-0063","summary":"Updated cinnamon packages fix security vulnerability","details":"A flaw was found in Cinnamon 1.9.2 through 3.8.6. The\ncinnamon-settings-users.py GUI runs as root and allows configuration of\n(for example) other users' icon files in _on_face_browse_menuitem_activated\nand _on_face_menuitem_activated. These icon files are written to the\nrespective user's $HOME/.face location. If an unprivileged user prepares a\nsymlink pointing to an arbitrary location, then this location will be\noverwritten with the icon content (CVE-2018-13054).\n","modified":"2026-04-16T04:44:02.856684895Z","published":"2019-02-13T11:08:25Z","upstream":["CVE-2018-13054"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2019-0063.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=23272"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XSADMZDE26IBCLBJOASR5ZX4E2OKKPVD/"},{"type":"WEB","url":"https://lists.opensuse.org/opensuse-updates/2018-07/msg00083.html"}],"affected":[{"package":{"name":"cinnamon","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/cinnamon?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.8-4.1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2019-0063.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}