[ubuntu/resolute-security] ubuntu-kylin-software-center 4.5.77.1ubuntu0.1 (Accepted)

[Eduardo Barretto]

ubuntu-kylin-software-center (4.5.77.1ubuntu0.1) resolute-security; urgency=low

  [ Pan Zhang ]
  * SECURITY UPDATE: root privilege escalation via command injection in
    D-Bus method copy_file_to_install (LP: #2154543)
    - kylin_software_center_daemon/apt_dbus_service.py: add signature
      verification to copy_file_to_install D-Bus method to prevent
      unprivileged users from exploiting command injection in os.system()
      to gain root privileges.
    - service/dbus_service.py: pass signature data when calling
      copy_file_to_install via D-Bus interface.

Date: 2026-06-10 16:40:46.823247+00:00
Changed-By: PanZhang <zhangpan at kylinos.cn>
Signed-By: Eduardo Barretto <eduardo.barretto at canonical.com>
https://launchpad.net/ubuntu/+source/ubuntu-kylin-software-center/4.5.77.1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.