Description
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnome-shell | 3.14.1-1 | — |
| Debian 13 | gnome-shell | 3.14.1-1 | — |
| Debian 12 | gnome-shell | 3.14.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | clutter +2 | 1.14.4-12.el7 | RHSA-2015:0535 |
| RHEL 7 | cogl +2 | 1.14.0-6.el7 | RHSA-2015:0535 |
| RHEL 7 | gnome-shell +1 | 3.8.4-45.el7 | RHSA-2015:0535 |
| RHEL 7 | mutter +1 | 3.8.4-16.el7 | RHSA-2015:0535 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | gnome-settings-daemon | 3.10.2-20.1 | SUSE-SU-2015:0515-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | gnome-settings-daemon | 3.10.2-20.1 | SUSE-SU-2015:0515-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | clutter +2 | 1.14.4-12.el7 | ELSA-2015-0535 |
| Oracle Linux 7 | cogl +2 | 1.14.0-6.el7 | ELSA-2015-0535 |
| Oracle Linux 7 | gnome-shell +1 | 3.8.4-45.el7 | ELSA-2015-0535 |
| Oracle Linux 7 | mutter +1 | 3.8.4-16.el7 | ELSA-2015-0535 |
Advisories 3
- RHSA-2015:0535 Red Hat Security Advisory: GNOME Shell security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- SUSE-SU-2015:0515-1 Security update for gnome-settings-daemon SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-0535 Low: GNOME Shell security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 11, 2015
References
- https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013
- RHSA-2015:0535 vendor-advisory
- https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378
- https://bugzilla.gnome.org/show_bug.cgi?id=737456
- [oss-security] 20140929 gnome-shell lockscreen bypass with printscreen key mailing-list