USN-8981-1: e17 vulnerability
It was discovered that the enlightenmentsys helper in Enlightenment incorrectly handled certain pathnames. A local attacker could possibly use this issue to gain administrator privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/e17to a version that resolves this vulnerability.Fixed in 0.17.6-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/e17to a version that resolves this vulnerability.Fixed in 0.17.6-1.1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/e17to a version that resolves this vulnerability.Fixed in 0.23.1-4ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/e17to a version that resolves this vulnerability.Fixed in 0.25.3-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/enlightenmentto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/e17to a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running the affected e17 or Enlightenment packages are exposed where a local attacker can execute code or otherwise access a local account. The issue is described as a local privilege-escalation vulnerability.
What level of access does an attacker need?
An attacker needs local access to the affected system. The provided information does not indicate that remote network access alone is sufficient.
What could successful exploitation allow?
A local attacker could possibly gain administrator privileges by exploiting incorrect pathname handling in the enlightenment_sys helper.