Vulnerability in Xscreensaver Project
CVE-2015-8025
driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 2.1 (Low). Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.005 (41.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Xscreensaver Project — versions 5.33
- Canonical Ubuntu Linux — versions 12.04
Weakness classification (CWE)
References
- www.jwz.org/blog/2015/10/xscreensaver-5-34/
- www.securitytracker.com/id/1034052 (vdb-entry)
- lists.opensuse.org/opensuse-updates/2015-11/msg00102.html (vendor-advisory)
- www.debian.org/security/2016/dsa-3438 (vendor-advisory)
- www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- www.openwall.com/lists/oss-security/2015/10/24/2 (mailing-list, Exploit)
- www.openwall.com/lists/oss-security/2015/10/25/1 (mailing-list)
- www.openwall.com/lists/oss-security/2015/10/29/12 (mailing-list)
- twitter.com/Thaolia/status/656823859304398848
- www.ubuntu.com/usn/USN-2789-1 (vendor-advisory)