Description
An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and, for example, intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sddm | 0.19.0-1 | — |
| Debian 13 | sddm | 0.19.0-1 | — |
| Debian 12 | sddm | 0.19.0-1 | — |
| Debian 10 | sddm | 0.18.0-1+deb10u1 | DSA-4783-1 |
| Debian 9 | sddm | 0.14.0-4+deb9u2 | DLA-2436-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | sddm | No fix yet | — |
| Ubuntu 18.04 LTS | sddm | No fix yet | — |
| Ubuntu 16.04 LTS | sddm | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | sddm | 0.18.0-bp152.5.3.1 | openSUSE-SU-2020:1899-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sddm | 0.19.0-4.2 | openSUSE-SU-2024:11376-1 |
| openSUSE Leap 15.2 | sddm | 0.18.0-lp152.5.3.1 | openSUSE-SU-2020:1870-1 |
| openSUSE Leap 15.1 | sddm | 0.18.0-lp152.5.3.1 | openSUSE-SU-2020:1870-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | sddm | 0.19.0-r0 | — |
| Alpine v3.23 | sddm | 0.19.0-r0 | — |
| Alpine v3.22 | sddm | 0.19.0-r0 | — |
| Alpine v3.21 | sddm | 0.19.0-r0 | — |
| Alpine v3.20 | sddm | 0.19.0-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | sddm | 0.19.0-r0 | — |
| Alpine v3.18 | sddm | 0.19.0-r0 | — |
| Alpine v3.17 | sddm | 0.19.0-r0 | — |
| Alpine v3.16 | sddm | 0.19.0-r0 | — |
| Alpine v3.15 | sddm | 0.19.0-r0 | — |
| Alpine v3.14 | sddm | 0.19.0-r0 | — |
| Alpine v3.13 | sddm | 0.19.0-r0 | — |
Advisories 5
- DSA-4783-1 sddm - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2436-1 sddm - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11376-1 sddm-0.19.0-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1870-1 Security update for sddm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1899-1 Security update for sddm SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/sddm/sddm/releases
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-28049
- https://github.com/sddm/sddm/blob/v0.19.0/ChangeLog
- DSA-4783 vendor-advisory
- [debian-lts-announce] 20201106 [SECURITY] [DLA 2436-1] sddm security update mailing-list
- openSUSE-SU-2020:1870 vendor-advisory
- FEDORA-2021-7066b95c99 vendor-advisory
- GLSA-202402-02 vendor-advisory