Description
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/QubesOS/qubes-issues/issues/6595 ↗
- https://www.openwall.com/lists/oss-security/2021/06/05/1 ↗
- https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt ↗
- https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch ↗
- http://www.openwall.com/lists/oss-security/2021/06/11/1 ↗
- http://www.openwall.com/lists/oss-security/2021/07/06/2 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/ ↗