Description
gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosedownGrabs enabled, allows attackers with physical access to cause the screensaver to crash and access the session via the Ctl+Alt+Keypad-Multiply keyboard sequence, which removes the grab from gnome.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | gnome-screensaver | 2.14.1-1 | — |
| Debian 12 | gnome-screensaver | 2.14.1-1 | — |
References
- gnomescreensaver-security-bypass(25340) vdb-entry
- 19280 third-party-advisory
- http://bugzilla.gnome.org/show_bug.cgi?id=326663
- 24015 vdb-entry