USN-4134-2: IBus regression | Ubuntu security notices

Packages

ibus - Intelligent Input Bus - core

Details

USN-4134-1 fixed a vulnerability in IBus. The security fix introduced a
regression when being used with Qt applications. This update reverts the
security fix pending further investigation.

Original advisory details:

Simon McVittie discovered that IBus did not enforce appropriate access
controls on its private D-Bus socket. A local unprivileged user who
discovers the IBus socket address of another user could exploit this to
capture the key strokes of the other user.

USN-4134-1 fixed a vulnerability in IBus. The security fix introduced a
regression when being used with Qt applications. This update reverts the
security fix pending further investigation.

Original advisory details:

Simon McVittie discovered that IBus did not enforce appropriate access
controls on its private D-Bus socket. A local unprivileged user who
discovers the IBus socket address of another user could exploit this to
capture the key strokes of the other user.

Update instructions

After a standard system update you need to reboot your computer to make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
19.04 disco	ibus – 1.5.19-1ubuntu2.2
18.04 bionic	ibus – 1.5.17-3ubuntu5.2
16.04 xenial	ibus – 1.5.11-1ubuntu2.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

https://launchpad.net/bugs/1844853