CVE-2019-3820

The GNOME Shell redefines user interactions with the GNOME desktop. In particular, it offers new paradigms for launching applications, accessing documents, and organizing open windows in GNOME. Later, it will introduce a new applets eco-system and offer new solutions for other desktop features, such as notifications and contacts management. The GNOME Shell is intended to replace functions handled by the GNOME Panel and by the window manager in previous versions of GNOME. The GNOME Shell has rich visual effects enabled by new graphical technologies.

Security Fix(es):

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.(CVE-2019-3820)

GNOME is the default desktop environment of Rocky Linux.

Security Fix(es):

• evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459)

• gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.

GNOME is the default desktop environment of AlmaLinux.

Security Fix(es):

• evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459)

• gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for gnome-shell fixes the following issues:

Security issue fixed:

• CVE-2019-3820: Fixed a partial lock screen bypass (bsc#1124493).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the gnome-extensions-40.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gnome-shell fixes the following issues:

Security issue fixed:

• CVE-2019-3820: Fixed a partial lock screen bypass (bsc#1124493).

Fixed bugs:

• Remove sessionList of endSessionDialog for security reasons (jsc#SLE-6660).

This update for gnome-shell fixes the following issues:

Security issue fixed:

• CVE-2019-3820: Fixed a partial lock screen bypass (bsc#1124493).

It was discovered that the GNOME Shell incorrectly handled certain keyboard inputs. An attacker could possibly use this issue to invoke keyboard shortcuts, and potentially other actions while the workstation was locked.

It was discovered that GNOME Shell mishandled extensions that fail to reload, possibly leading to extensions staying enabled on the lock screen. An attacker could possibly use this issue to launch applications, view sensitive information, or execute arbitrary commands. (CVE-2017-8288)

It was discovered that the GNOME Shell incorrectly handled certain keyboard inputs. An attacker could possibly use this issue to invoke keyboard shortcuts, and potentially other actions while the workstation was locked. (CVE-2019-3820)