[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <52BD44EB.2060705@redhat.com>
Date: Fri, 27 Dec 2013 14:44:19 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
CC: cve-assign@...re.org
Subject: Re: Re: Two CVE request for gnome-shell/screensaver
issues
On 12/27/2013 12:03 PM, cve-assign@...re.org wrote:
>> https://bugzilla.gnome.org/show_bug.cgi?id=686740
>> https://git.gnome.org/browse/gnome-shell/log/js/ui/screenShield.js?qt=grep&q=686740
>> Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1030431
>
> The discussion in 686740 focuses on usability problems, not security
> problems. Comment 11 in 1030431 says "typing away at the lock screen
> will now trigger the unlock dialog (and redirect input to the password
> field)." Does this mean that 209014b083dbe86ed0e0860a6016735571b56f94
> is a security fix, and the other screenShield.js commits are usability
> fixes? Or does it mean that 127f10e7a8bbbbd089d217f8cd89971c187ae9c3
> is a security fix because the "will be dropped in the void"
> description isn't always accurate, and "will be dropped into the
> Activities panel" or "will be dropped into the 'Enter a command'
> dialog box" can occur instead?
>
>
209014b083dbe86ed0e0860a6016735571b56f94 ensures that the keypress
always goes to the login dialog box, while
127f10e7a8bbbbd089d217f8cd89971c187ae9c3 seems to be usability fix to me.
--
Huzaifa Sidhpurwala / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
