gdm-50.2

[Bruce Dubbs]

New minor version.

[Bruce Dubbs]

50.2

• Fixed path traversal vulnerability where a compromised greeter could load arbitrary .desktop files via SelectSession, potentially executing attacker-controlled commands as the authenticated user.
• Fixed autologin bypass where a compromised greeter could request autologin for any local account by sending arbitrary usernames via BeginAutoLogin.
• Fixed denial of service where an invalid session name from the greeter would cause the entire daemon to exit, terminating all active sessions.
• Fixed passphrase handling in pam_gdm to wipe cached plaintext passwords before freeing and to bound the keyring buffer walk preventing out-of-bounds reads.
• Fixed crashes, memory leaks and wrong hash key type in reauthentication channel handler, session worker and dynamic user store,
• Translation updates

[Bruce Dubbs]

Fixed at commits

ce66ba0f73 Update to gdm-50.2.
a5a049424d Update to mutter-50.4.
b3f45d6f23 Update to gnome-shell-50.4.