plasma-workspace CVE-2016-2312

[Nick B.]

The plasma-workspace package is vulnerable to CVE-2016-2312. The bug has been fixed upstream see https://www.kde.org/info/security/advisory-20160209-1.txt

The specific patch needed for Ubuntu 15.10 is http://commits.kde.org/plasma-workspace/23a9ed7ba9995570227dbcd69c23f009de7dde49

plasma-workspace:
  Installed: 4:5.4.2-0ubuntu1
  Candidate: 4:5.4.2-0ubuntu1
  Version table:
 *** 4:5.4.2-0ubuntu1 0
        500 http://mirror.us.leaseweb.net/ubuntu/ wily/universe amd64 Packages
        100 /var/lib/dpkg/status

[Nick B. (futurepilot)]

Debdiff for plasma-workspace

[Seth Arnold (seth-arnold)]

Thanks Nick, packages are building now, I'll release them tomorrow.

I made some changes:

- I modified the debian/changelog to match our format https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation
- I modified the patch to include dep3 tags: http://dep.debian.net/deps/dep3/

Thanks

[Launchpad Janitor (janitor)]

This bug was fixed in the package plasma-workspace - 4:5.4.2-0ubuntu1.1

---------------
plasma-workspace (4:5.4.2-0ubuntu1.1) wily-security; urgency=medium

  * SECURITY UPDATE: lock screen bypass by turning monitor off and on
    (LP: #1554656)
    - debian/patches/plasma-workspace-CVE-2016-2312.patch - fix lockscreen for
      turning monitor off and on
    - CVE-2016-2312

 -- Nick Bryda <email address hidden> Tue, 08 Mar 2016 12:02:28 -0500