Ubuntu
blueman package

  1. Groovy (20.10)
  2. Bug #1897287
  3. Comment #17

Comment 17 for bug 1897287

Revision history for this message
cschramm (cschramm) wrote : Re: Local privilege escalation in blueman

23.10.20 20:39 Emilia Torino:
 > On 23/10/20 10:38, cschramm wrote:
 >> It seems like there actually are Ubuntu updates waiting to get released.
 >
 > That's correct

 > Tuesday 27th sounds perfect for the Ubuntu security team. Can you please
 > also define a time (UTC) so we make sure we release the updates
 > appropriately?

I'll pick... 09:00 UTC. 🤷

I'm going to publish upstream
- a GitHub security advisory
- version 2.1.4 with the fix and a reference to the security advisory
- the same fix in master
around that time or a little later.

(Most) other distributions than Debian and Ubuntu (and derivatives) are
not at risk as they use Policykit authorization and rules that allow the
actions only to users that have the desired privileges anyway.

Cheers