Description
rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xscreensaver | 4.18-1 | — |
| Debian 13 | xscreensaver | 4.18-1 | — |
| Debian 12 | xscreensaver | 4.18-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | xscreensaver | 1:4.10-20 | RHSA-2006:0498 |
Advisories 1
- RHSA-2006:0498 Red Hat Security Advisory: xscreensaver security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://www.jwz.org/xscreensaver/changelog.html
- http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm
- http://www.derkeiler.com/Newsgroups/comp.os.linux.security/2004-08/0018.html
- SUSE-SR:2006:023 vendor-advisory
- MDKSA-2006:071 vendor-advisory
- 20782 third-party-advisory
- RHSA-2006:0498 vendor-advisory
- oval:org.mitre.oval:def:10096 vdb-entry signature
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188149
- 22080 third-party-advisory
- 20456 third-party-advisory
- 1016151 vdb-entry
- 17471 vdb-entry
- USN-269-1 vendor-advisory
- 1016150 vdb-entry
- 20226 third-party-advisory