Re: Re: Two CVE request for gnome-shell/screensaver issues

[Huzaifa Sidhpurwala <huzaifas () redhat com>]

On 12/27/2013 12:03 PM, cve-assign () mitre org wrote:
> > https://bugzilla.gnome.org/show_bug.cgi?id=686740
> > https://git.gnome.org/browse/gnome-shell/log/js/ui/screenShield.js?qt=grep&q=686740
> > Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1030431
>
> The discussion in 686740 focuses on usability problems, not security
> problems. Comment 11 in 1030431 says "typing away at the lock screen
> will now trigger the unlock dialog (and redirect input to the password
> field)." Does this mean that 209014b083dbe86ed0e0860a6016735571b56f94
> is a security fix, and the other screenShield.js commits are usability
> fixes? Or does it mean that 127f10e7a8bbbbd089d217f8cd89971c187ae9c3
> is a security fix because the "will be dropped in the void"
> description isn't always accurate, and "will be dropped into the
> Activities panel" or "will be dropped into the 'Enter a command'
> dialog box" can occur instead?

209014b083dbe86ed0e0860a6016735571b56f94 ensures that the keypress
always goes to the login dialog box, while
127f10e7a8bbbbd089d217f8cd89971c187ae9c3 seems to be usability fix to me.




-- 
Huzaifa Sidhpurwala / Red Hat Security Response Team