XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication.
CVSS Details
- CVSS 3.1 Base Score: 7.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xscreensaver | Jul 30, 2024 | May 2, 2007 |
| Gentoo Linux | — | Upgrade x11-misc/xscreensaver. | Oct 30, 2017 | May 2, 2007 |
| Suse | — | Upgrade xscreensaverUpgrade suse-release | Feb 17, 2015 | May 2, 2007 |
| Ubuntu | — | Upgrade xscreensaver | Nov 8, 2024 | May 2, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub