Description
The KDE screen saver in KDE before 3.0.5 does not properly check the return value from a certain function call, which allows attackers with physical access to cause a crash and access the desktop session.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kdebase | 4:2.2.2-14.9 | DSA-660-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kdebase +1 | 6:3.1.3-5.8 | RHSA-2005:009 |
| RHEL 3 | kdelibs +1 | 6:3.1.3-6.9 | RHSA-2005:009 |
Advisories 2
- RHSA-2005:009 Red Hat Security Advisory: kdelibs, kdebase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-660-1 kdebase - missing return value check Debian Security (DSA / DLA) · Mar 9, 2026
References
- kdebase-screensaver-security-bypass(19084) vdb-entry
- oval:org.mitre.oval:def:9260 vdb-entry signature
- DSA-660 vendor-advisory
- RHSA-2005:009 vendor-advisory