gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade gtk+2.0 | Jul 30, 2024 | Mar 19, 2010 |
| Gentoo Linux | — | Upgrade x11-apps/xinit.Upgrade kde-base/kdm.Upgrade app-antivirus/bitdefender-console.Upgrade sys-apps/pmount.Upgrade app-text/gv.Upgrade net-mail/mlmmj.Upgrade dev-util/insight.Upgrade sys-block/partimage.Upgrade media-tv/dvbstreamer.Upgrade www-client/uzbl.Upgrade kde-base/kget.Upgrade net-ftp/lftp.Upgrade app-text/dvipng.Upgrade dev-util/sourcenav.Upgrade sys-auth/pam_krb5.Upgrade app-arch/gzip.Upgrade media-gfx/splashutils.Upgrade sys-devel/m4.Upgrade x11-libs/gtk+.Upgrade dev-perl/perl-tk.Upgrade dev-libs/liblzw.Upgrade dev-lang/tk.Upgrade sys-apps/acl.Upgrade x11-misc/slim.Upgrade net-misc/iputils.Upgrade app-misc/beanstalkd.Upgrade app-arch/ncompress. | Oct 30, 2017 | Mar 19, 2010 |
| Suse | — | Upgrade gnome-screensaverUpgrade gnome-screensaver-lang | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub