Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 501470 (CVE-2014-1845) - <x11-wm/enlightenment-0.17.6 : two vulnerabilities (CVE-2014-{1845-1846})
Summary: <x11-wm/enlightenment-0.17.6 : two vulnerabilities (CVE-2014-{1845-1846})
Alias: CVE-2014-1845
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~4 [noglsa]
Depends on:
Reported: 2014-02-16 11:33 UTC by Agostino Sarubbo
Modified: 2014-02-16 14:57 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-02-16 11:33:48 UTC
From ${URL} :

Red Hat Security suggested I request a CVE here since this potentially
effects multiple distros/maintainers. The Enlightenment window manager
( was found to ship with (a) a setuid root helper that
did not effectively sanitize its environment and (b) a weak default
configuration. Users in select groups could exploit this to execute
arbitrary programs as root.

This was fixed upstream in 3 commits each for both e17 and e18 branches,
with two new releases shipped shortly after:
  0.17.6, Dec  4th 2013: [1], [2], [3]
  0.18.0, Dec 21st 2013: [4], [5], [6]

Fedora has a bug filed against it at [7] referencing the e18 commits.




@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Comment 1 Thomas Sachau gentoo-dev 2014-02-16 14:20:46 UTC
e17 currently has no stable release, only testing keywords, version 0.17.6 is in the main tree, older versions have just been removed.
e18 is in the enlightenment overlay and there we already have 0.18.3

Anything left to do?
Comment 2 Agostino Sarubbo gentoo-dev 2014-02-16 14:57:41 UTC
(In reply to Thomas Sachau from comment #1)
> Anything left to do?

No. Closing as noglsa