CVE-2018-13054

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-02 · updated 2026-06-17
Weakness: CWE-59

Description

An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.

Affected products

Debian Linux: 8.0
LinuxMint Cinnamon: from 1.9.2 through 3.8.6

References

https://bugzilla.suse.com/show_bug.cgi?id=1083067
https://github.com/linuxmint/Cinnamon/pull/7683
https://lists.debian.org/debian-lts-announce/2018/07/msg00011.html
https://bugzilla.suse.com/show_bug.cgi?id=1083067
https://github.com/linuxmint/Cinnamon/pull/7683
https://lists.debian.org/debian-lts-announce/2018/07/msg00011.html

Get alerted when CVE-2018-13054 or the next vulnerability affects your stack