Permissions, Privileges, and Access Controls in xscreensaver - CVE-2015-8025
Published: November 10, 2015 / Updated: July 28, 2020
Vulnerability identifier: #VU32377
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8025
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to manipulate data.
driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.
Affected software
xscreensaver
xscreensaver (Alpine package)
xscreensaver (Alpine package)
How to mitigate CVE-2015-8025
Install update from vendor's website.
xscreensaver - update to 5.34
xscreensaver (Alpine package) - update to 5.34-r0
xscreensaver (Alpine package) - update to 5.34-r0
External References
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00102.html
- http://www.debian.org/security/2016/dsa-3438
- http://www.openwall.com/lists/oss-security/2015/10/24/2
- http://www.openwall.com/lists/oss-security/2015/10/25/1
- http://www.openwall.com/lists/oss-security/2015/10/29/12
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.securitytracker.com/id/1034052
- http://www.ubuntu.com/usn/USN-2789-1
- https://twitter.com/Thaolia/status/656823859304398848
- https://www.jwz.org/blog/2015/10/xscreensaver-5-34/