Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file

[Salvatore Bonaccorso <carnil@debian.org>]

Hi Norbert,

On Thu, Nov 05, 2020 at 08:26:07PM +0900, Norbert Preining wrote:
> Hi Salvatore, hi FTP Master,
> 
> @Salvatore: thanks for the NMU preparation. We are now preparing a fix
> for unstable via version 0.19, and at the same time I thought I upload
> to buster-security, based on your patch,
> 
> But, uploading to security-master with dput I got the following answer:
> 
> On Thu, 05 Nov 2020, Debian FTP Masters wrote:
> > sddm_0.18.0-1+deb10u1.dsc: Does not match file already existing in the pool.
> 
> Do you or ftpmaster could explain me what I did wrong?
> 
> The included files are
> Checksums-Sha1:
>  f8d882dbf4cf377fa0c7a4277a56b7f7c25e2a64 2334 sddm_0.18.0-1+deb10u1.dsc
>  a33d316b613a52b2af435c3516ed9abac7ea34d5 52864 sddm_0.18.0-1+deb10u1.debian.tar.xz
>  5ed47e94dc64af78fe960358b8b009afb840e16a 13613 sddm_0.18.0-1+deb10u1_source.buildinfo
> and the upload was a source-only to Distribution: buster-security.

That is because I did already upload the upload yesterday as with the
debdiff attached to the bugreport. But we (Moritz was testing as well)
wanted to further test the upload first before releasing the DSA.

Fixing this via unstable via directly 0.19 sounds great, thank you.

Regards,
Salvatore