Vulnerability · Published Jun 10, 2021 · Assigned by mitre
CVE-2021-34557
Medium 4.6
In plain English
A medium-severity security flaw in the xscreensaver package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.6Medium
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xscreensaver | 6.02-r0 | ALPINE-CVE-2021-34557 |
| Alpine:v3.21 | xscreensaver | 6.02-r0 | ALPINE-CVE-2021-34557 |
| Alpine:v3.22 | xscreensaver | 6.02-r0 | ALPINE-CVE-2021-34557 |
| Alpine:v3.23 | xscreensaver | 6.02-r0 | ALPINE-CVE-2021-34557 |
| Alpine:v3.24 | xscreensaver | 6.02-r0 | ALPINE-CVE-2021-34557 |
| Debian:12 | xscreensaver | 5.45+dfsg1-2 | DEBIAN-CVE-2021-34557 |
| Debian:13 | xscreensaver | 5.45+dfsg1-2 | DEBIAN-CVE-2021-34557 |
| Debian:14 | xscreensaver | 5.45+dfsg1-2 | DEBIAN-CVE-2021-34557 |
| Ubuntu:22.04:LTS | xscreensaver | no fix listed | UBUNTU-CVE-2021-34557 |
Affected products (as reported)
References
- https://github.com/QubesOS/qubes-issues/issues/6595 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/06/05/1 x_refsource_MISC
- https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt x_refsource_MISC
- https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch x_refsource_MISC
- [oss-security] 20210611 Re: XScreenSaver 5.45: Disconnecting a video output can cause XScreenSaver to crash and unlock mailing-list, x_refsource_MLIST
- [oss-security] 20210706 xscreensaver 5.45 crash mailing-list, x_refsource_MLIST
- FEDORA-2021-5af4452ffd vendor-advisory, x_refsource_FEDORA