Date: Fri, 27 Dec 2013 14:44:19 +0530 From: Huzaifa Sidhpurwala <huzaifas@...hat.com> To: oss-security@...ts.openwall.com CC: cve-assign@...re.org Subject: Re: Re: Two CVE request for gnome-shell/screensaver issues On 12/27/2013 12:03 PM, cve-assign@...re.org wrote: >> https://bugzilla.gnome.org/show_bug.cgi?id=686740 >> https://git.gnome.org/browse/gnome-shell/log/js/ui/screenShield.js?qt=grep&q=686740 >> Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1030431 > > The discussion in 686740 focuses on usability problems, not security > problems. Comment 11 in 1030431 says "typing away at the lock screen > will now trigger the unlock dialog (and redirect input to the password > field)." Does this mean that 209014b083dbe86ed0e0860a6016735571b56f94 > is a security fix, and the other screenShield.js commits are usability > fixes? Or does it mean that 127f10e7a8bbbbd089d217f8cd89971c187ae9c3 > is a security fix because the "will be dropped in the void" > description isn't always accurate, and "will be dropped into the > Activities panel" or "will be dropped into the 'Enter a command' > dialog box" can occur instead? > > 209014b083dbe86ed0e0860a6016735571b56f94 ensures that the keypress always goes to the login dialog box, while 127f10e7a8bbbbd089d217f8cd89971c187ae9c3 seems to be usability fix to me. -- Huzaifa Sidhpurwala / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.