Vulnerability · Published Apr 21, 2021 · Assigned by mitre
CVE-2021-31523
High 7.8
In plain English
A high-severity security flaw in the xscreensaver package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 75.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | xscreensaver | 5.45+dfsg1-2 | DEBIAN-CVE-2021-31523 |
| Debian:13 | xscreensaver | 5.45+dfsg1-2 | DEBIAN-CVE-2021-31523 |
| Debian:14 | xscreensaver | 5.45+dfsg1-2 | DEBIAN-CVE-2021-31523 |
| Ubuntu:22.04:LTS | xscreensaver | no fix listed | UBUNTU-CVE-2021-31523 |
| Ubuntu:24.04:LTS | xscreensaver | no fix listed | UBUNTU-CVE-2021-31523 |
| Ubuntu:25.10 | xscreensaver | no fix listed | UBUNTU-CVE-2021-31523 |
| Ubuntu:26.04:LTS | xscreensaver | no fix listed | UBUNTU-CVE-2021-31523 |
| Ubuntu:26.10 | xscreensaver | no fix listed | UBUNTU-CVE-2021-31523 |
Affected products (as reported)
References
- https://www.openwall.com/lists/oss-security/2021/04/17/1 x_refsource_MISC
- [oss-security] 20210421 Re: xscreensaver package caps gets raw socket mailing-list, x_refsource_MLIST