Description
GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cinnamon | 2.2.14-1 | — |
| Debian 14 | gtk+3.0 | 3.11.8-1 | — |
| Debian 13 | cinnamon | 2.2.14-1 | — |
| Debian 13 | gtk+3.0 | 3.11.8-1 | — |
| Debian 12 | cinnamon | 2.2.14-1 | — |
| Debian 12 | gtk+3.0 | 3.11.8-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | gtk+3.0 | 3.10.8-0ubuntu1.4 | — |
References
- [oss-security] 20140212 cinnamon-screensaver lock bypass (tested on Fedora 20) mailing-list
- USN-2475-1 vendor-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759145
- MDVSA-2015:162 vendor-advisory
- https://github.com/linuxmint/cinnamon-screensaver/issues/44
- http://advisories.mageia.org/MGASA-2014-0374.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1064695
- [oss-security] 20140212 Re: cinnamon-screensaver lock bypass (tested on Fedora 20) mailing-list