Debian Xscreensaver vulnerabilities

CVE-2021-31523 [HIGH] CVE-2021-31523: xscreensaver - The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw en... The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency. Scope: local bookworm: resolved (fixed in 5.45+dfsg1-2) bullseye: resolved (fixed in 5.45

CVE-2021-34557 [MEDIUM] CVE-2021-34557: xscreensaver - XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectabl... XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. Scope: local bookworm: resolved (fixed in 5.45+dfsg1-2)

CVE-2015-8025 [LOW] CVE-2015-8025: xscreensaver - driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an inter... driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors. Scope: local bookworm: resolved (fixed in 5.34-1) bullseye: resolved (fixed in 5.34-1) forky: resolved (fixed in 5.34-1) sid: resolved (fixed in 5.34-1) trixie: resolv

CVE-2011-2187 [HIGH] CVE-2011-2187: xscreensaver - xscreensaver before 5.14 crashes during activation and leaves the screen unlocke... xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication. Scope: local bookworm: resolved (fixed in 5.14-1) bullseye: resolved (fixed in 5.14-1) forky: resolved (fixed in 5.14-1) sid: resolved (fixed in 5.14-1) trixie

CVE-2010-3586 [LOW] CVE-2010-3586: xscreensaver - Unspecified vulnerability in Oracle Solaris 9 allows local users to affect confi... Unspecified vulnerability in Oracle Solaris 9 allows local users to affect confidentiality and integrity via unknown vectors related to XScreenSaver. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2009-3100 [MEDIUM] CVE-2009-3100: xscreensaver - xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 9 and 10, OpenSolaris snv_1... xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 9 and 10, OpenSolaris snv_109 through snv_122, and X11 6.4.1 on Solaris 8 does not properly handle Accessibility support, which allows local users to cause a denial of service (system hang) by locking the screen and then attempting to launch an Accessibility pop-up window, related to a regression in certain S

CVE-2009-3101 [MEDIUM] CVE-2009-3101: xscreensaver - xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 10, and OpenSolaris snv_109... xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 10, and OpenSolaris snv_109 through snv_122, does not properly handle Trusted Extensions, which allows local users to cause a denial of service (CPU consumption and console hang) by locking the screen, related to a regression in certain Solaris and OpenSolaris patches. Scope: local bookworm: resolved bullseye

CVE-2007-5585 [MEDIUM] CVE-2007-5585: xscreensaver - xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL e... xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session. Scope: local bookworm: resolved (fixed in 5.03-3.1) bullseye: resolved (fixed in

CVE-2007-1859 [MEDIUM] CVE-2007-1859: xscreensaver - XScreenSaver 4.10, when using a remote directory service for credentials, does n... XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication. Scope: local bookworm: resolved (fixed in 5.03-1) bullseye: re

CVE-2007-3283 [MEDIUM] CVE-2007-3283: xscreensaver - GNOME XScreenSaver in Sun Solaris 8 and 9 before 20070417, when root is logged i... GNOME XScreenSaver in Sun Solaris 8 and 9 before 20070417, when root is logged into the console, does not automatically lock the screen after a session has been inactive, which might allow physically proximate attackers to access the console. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2004-2655 [MEDIUM] CVE-2004-2655: xscreensaver - rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running... rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen. Scope: local bookworm: resolved (fixed in 4.18-1) bullseye: resolved (fixed in 4.18

CVE-2003-0885 [MEDIUM] CVE-2003-0885: xscreensaver - Xscreensaver 4.14 contains certain debugging code that should have been omitted,... Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecurely in the (1) apple2, (2) xanalogtv, and (3) pong screensavers, and allows local users to overwrite arbitrary files via a symlink attack. Scope: local bookworm: resolved (fixed in 4.15) bullseye: resolved (fixed in 4.15) f

CVE-2003-1295 [LOW] CVE-2003-1295: xscreensaver - Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, all... Unspecified vulnerability in xscreensaver 4.12, and possibly other versions, allows attackers to cause xscreensaver to crash via unspecified vectors "while verifying the user-password." Scope: local bookworm: resolved (fixed in 4.21-1) bullseye: resolved (fixed in 4.21-1) forky: resolved (fixed in 4.21-1) sid: resolved (fixed in 4.21-1) trixie: resolved (fixed in

CVE-2003-1294 [LOW] CVE-2003-1294: xscreensaver - Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd... Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack. Scope: local bookworm: resolved (fixed in 4.15-1) bullseye: resolved