CVE-2012-0943
published 2014-05-22CVE-2012-0943: debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete…
PriorityP416low2.1CVSS 2.0
AVLACLAuNCNINAP
EXPLOIT
EPSS
0.76%
50.7th percentile
debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-6648 has been assigned for the gdm-guest-session issue.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | lightdm | — | — |
| gdm-guest-session_project | gdm-guest-session | <= 0.24 | — |
| gdm-guest-session_project | gdm-guest-session | — | — |
| gdm-guest-session_project | gdm-guest-session | — | — |
| gdm-guest-session_project | gdm-guest-session | — | — |
| gdm-guest-session_project | gdm-guest-session | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
| robert_ancell | lightdm | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
vendor_debian2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Light Display Manager vulnerability
vendor_ubuntu·2012-03-13
CVE-2012-0943 Light Display Manager vulnerability
Title: Light Display Manager vulnerability
Summary: Light Display Manager could be made to delete files as the administrator.
Ryan Lortie discovered that a guest session script bundled in the Light
Display Manager package improperly cleaned out certain guest session files.
A local attacker could use this issue to delete arbitrary files.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
gdm-guest-session vulnerability
vendor_ubuntu·2012-03-13
CVE-2012-0943 gdm-guest-session vulnerability
Title: gdm-guest-session vulnerability
Summary: gdm-guest-session could be made to delete files as the administrator.
Ryan Lortie discovered that gdm-guest-session improperly cleaned out
certain guest session files. A local attacker could use this issue to
delete arbitrary files.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2012-0943: lightdm - debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1...
vendor_debian·2012·CVSS 2.1
CVE-2012-0943 [LOW] CVE-2012-0943: lightdm - debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1...
debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-6648 has been assigned for the gdm-guest-session issue.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-cjj6-j9p7-88r5: gdm/guest-session-cleanup
ghsa_unreviewed·2022-05-17·CVSS 2.1
CVE-2012-6648 [LOW] GHSA-cjj6-j9p7-88r5: gdm/guest-session-cleanup
gdm/guest-session-cleanup.sh in gdm-guest-session 0.24 and earlier, as used in Ubuntu Linux 10.04 LTS, 10.10, and 11.04, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT from CVE-2012-0943 per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-0943 is used for the guest-account issue.
GHSA
GHSA-337g-q3wh-m8q8: debian/guest-account in Light Display Manager (lightdm) 1
ghsa_unreviewed·2022-05-17·CVSS 2.1
CVE-2012-0943 [LOW] GHSA-337g-q3wh-m8q8: debian/guest-account in Light Display Manager (lightdm) 1
debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-6648 has been assigned for the gdm-guest-session issue.
No detection rules found.
No writeups or analysis indexed.
http://www.ubuntu.com/usn/USN-1399-2https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044https://launchpadlibrarian.net/96471251/lightdm.secure-cleanup.debdiffhttp://www.ubuntu.com/usn/USN-1399-2https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044https://launchpadlibrarian.net/96471251/lightdm.secure-cleanup.debdiff
2014-05-22
Published