Description
The gesture handling code in Clutter before 1.16.2 allows physically proximate attackers to bypass the lock screen via certain (1) mouse or (2) touch gestures.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | clutter-1.0 | 1.18.0-1 | — |
| Debian 13 | clutter-1.0 | 1.18.0-1 | — |
| Debian 12 | clutter-1.0 | 1.18.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | clutter +2 | 1.14.4-12.ael7b_1.1 | RHSA-2015:1510 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | clutter +2 | 1.14.4-12.el7_1.1 | ELSA-2015-1510 |
Advisories 2
- RHSA-2015:1510 Red Hat Security Advisory: clutter security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ELSA-2015-1510 Moderate: clutter security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 27, 2015