[CVE] Socket may be blocked by another user

[Simon Quigley]

The socket placed in /tmp is predictable and public-writable. Therefore
if one user placed a symlink to another socket instead of socket for
another use then said another user will either be unable to get menu, or
will receive menu of some other user. Upstream released a fix for this
issue:

https://git.lxde.org/gitweb/?p=lxde/menu-cache.git;a=commitdiff;h=56f66684592abf257c4004e6e1fff041c64a12ce

[Simon Quigley (tsimonq2)]

Attached is a debdiff for Zesty applicable to 1.0.2-1. I have tested this on a fresh Lubuntu 17.04 install and it works fine.

[Simon Quigley (tsimonq2)]

Attached is a debdiff for Xenial applicable to 1.0.1-1build1. I have tested this on a fresh Lubuntu 16.04 LTS install and it works fine.

[Simon Quigley (tsimonq2)]

Attached is a debdiff for Trusty applicable to 0.5.1-1ubuntu1. I have tested this on a fresh Lubuntu 14.04 LTS install and it works fine.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs. I've uploaded them for building as a security update with the following minor changes in the patch tags:

- used launchpad url instead of url-shortener
- used the correct commit id

I will release them on Monday.
Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package menu-cache - 1.0.1-1ubuntu0.1

---------------
menu-cache (1.0.1-1ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Socket may be blocked by another user (LP: #1703564)
    - fix-CVE-2017-8933.patch
    - CVE-2017-8933

 -- Simon Quigley <email address hidden> Wed, 09 Aug 2017 08:54:28 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package menu-cache - 1.0.2-1ubuntu0.1

---------------
menu-cache (1.0.2-1ubuntu0.1) zesty-security; urgency=medium

  * SECURITY UPDATE: Socket may be blocked by another user (LP: #1703564)
    - fix-CVE-2017-8933.patch
    - CVE-2017-8933

 -- Simon Quigley <email address hidden> Wed, 09 Aug 2017 08:42:38 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package menu-cache - 0.5.1-1ubuntu1.1

---------------
menu-cache (0.5.1-1ubuntu1.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Socket may be blocked by another user (LP: #1703564)
    - fix-CVE-2017-8933.patch
    - CVE-2017-8933

 -- Simon Quigley <email address hidden> Wed, 09 Aug 2017 08:59:35 -0500