This bug was fixed in the package ukui-control-center -
4.20.0.2-0ubuntu1
---------------
ukui-control-center (4.20.0.2-0ubuntu1) stonking; urgency=medium
* Bugfix only:
- Fixed unauthenticated APT and profile configuration injection through
setaptproxy. (LP: #2160491)
- Fixed a polkit bypass and root command injection through setGrupPasswd.
(LP: #2160492)
- Fixed reading the grub boot menu by using the root system D-Bus
service instead of kdk_system_get_grub_menu(), which fails now
that grub.cfg is generated with mode 600.
- Fixed the user avatar to show the default Kylin face instead of the
Debian swirl logo when it is the system default .face file.
- Fixed the lock screen to fall back to the desktop or distro default
wallpaper when the configured lock background is missing.
- Fixed window ghosting on compositors without real blur support
(such as ukwm) by rendering the window opaque.
- Fixed a libddcutil abort by using DDCA_Display_Info.dref instead of
the deprecated ddca_create_display_ref().
- Added libcrypt-dev to the build dependencies and linked the userinfo
plugin against libcrypt.
- Bumped the debhelper compat level to 14 and Standards-Version to
4.7.4, and distinguished the libukcc runtime and -dev descriptions.
-- handsome_feng <[email protected]> Thu, 17 Sep 2026
15:41:09 +0800
** Changed in: ukui-control-center (Ubuntu)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160492
Title:
ukui-control-center setGrupPasswd permits polkit bypass and root
command injection
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ukui-control-center/+bug/2160492/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
