In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.
| Software | From | Fixed in |
|---|---|---|
| lightdm_project / lightdm | - | 1.22.0.x |
| canonical / ubuntu_linux | 16.10 | 16.10.x |
| canonical / ubuntu_linux | 16.04 | 16.04.x |