CVE Catalog
CVE-2017-15131
LowSummary
On Red Hat Enterprise Linux systems with xdg-user-dirs before 0.15.5, the system umask policy is not honored when creating XDG user directories because Xsession sources xdg-user-dirs.sh before setting umask. This may lead to incorrect directory permissions.
Risk Assessment
Incorrect user directory permissions may allow other local users to access sensitive files or escalate privileges.
Recommendation
Update xdg-user-dirs to version 0.15.5 or later. As a workaround, manually set umask before starting the X session.
Original NVD description (English source)
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.