Xscreensaver - Security Update (DSA-3438-1)
Summary
DSA-3438-1: xscreensaver - security update. Affects xscreensaver versions < 5.15-3+deb7u1. Fixed in 5.15-3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xscreensaver is a screen saver and locker for the X Window System. It is designed to be lightweight and customizable, offering a variety of screensaver modes and options. Xscreensaver is commonly used on Debian-based systems to protect the privacy and security of user sessions.
Vulnerability Detail
A vulnerability has been discovered in Xscreensaver that allows an attacker with physical access to a machine to bypass a locked session. The issue occurs when one of the monitors in a multi-monitor setup is unplugged, causing Xscreensaver to crash. This vulnerability poses a risk to systems where physical security cannot be guaranteed, as an attacker could gain unauthorized access to a locked session and potentially compromise sensitive information.
How To Fix
Minimum fixed version
5.15-3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade xscreensaverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
Xscreensaver versions prior to 5.15-3+deb7u1 for wheezy and 5.30-1+deb8u1 for jessie are vulnerable to a bypass of locked sessions when one of the monitors in a multi-monitor setup is unplugged. It is recommended to upgrade to the patched versions to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xscreensaver →
FAQ
Xscreensaver is a screen saver and locker for the X Window System, providing various screensaver modes and options.
This vulnerability allows an attacker with physical access to bypass a locked session, potentially compromising sensitive information.
The vulnerability affects Xscreensaver versions prior to 5.15-3+deb7u1 for the oldstable distribution (wheezy), and versions prior to 5.30-1+deb8u1 for the stable distribution (jessie).
To upgrade Xscreensaver, use the package manager of your Debian-based distribution and install the patched version corresponding to your distribution's release.
No specific workaround has been provided for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for xscreensaver.
