unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

This update for lxterminal fixes the following security issue :

  - CVE-2016-10369: insecure /tmp usage for a socket file     (boo#1038127)

A potential security flaw is found on LXDE products, which create socket under /tmp with some predictable names, which may leads to DOS.
The security flow on lxterminal is now assigned as CVE-2016-10369.
Some other components also had similar issues. These new rpms should fix these issues. 

At least relogin is required to make this fix effect.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a local denial of service vulnerability in lxterminal, the terminal emulator for the LXDE desktop environment.

This was caused by an insecure use of temporary files for a socket file.

For Debian 7 'Wheezy', this issue has been fixed in lxterminal version 0.1.11-4+deb7u1.

We recommend that you upgrade your lxterminal packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
106217	openSUSE Security Update : lxterminal (openSUSE-2018-51)	Nessus	SuSE Local Security Checks	high
101743	Fedora 26 : lxterminal / menu-cache / pcmanfm (2017-e9936d561b)	Nessus	Fedora Local Security Checks	high
100562	Fedora 24 : lxterminal / menu-cache / pcmanfm (2017-3f2d5790d2)	Nessus	Fedora Local Security Checks	high
100228	Fedora 25 : lxterminal / menu-cache / pcmanfm (2017-6950ea5d05)	Nessus	Fedora Local Security Checks	high
100107	Debian DLA-935-1 : lxterminal security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-10369

high

Tenable Plugins

high

high

high

high

high