CVE-2021-34557

XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.6 MEDIUM
PHYSICAL
LOW
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
VendorProductVersion
xscreensaver_projectxscreensaver
5.45
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xscreensaver
bullseye
5.45+dfsg1-2
fixed
buster
no-dsa
stretch
postponed
bookworm
6.06+dfsg1-3+deb12u1
fixed
sid
6.08+dfsg1-1
fixed
trixie
6.08+dfsg1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xscreensaver
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
groovy
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2021/06/11/1
http://www.openwall.com/lists/oss-security/2021/07/06/2
https://github.com/QubesOS/qubes-issues/issues/6595
https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt
https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/
https://www.openwall.com/lists/oss-security/2021/06/05/1
http://www.openwall.com/lists/oss-security/2021/06/11/1
http://www.openwall.com/lists/oss-security/2021/07/06/2
https://github.com/QubesOS/qubes-issues/issues/6595
https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt
https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/
https://www.openwall.com/lists/oss-security/2021/06/05/1