bugtraq - [USN-898-1] gnome-screensaver vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 10 Feb 2010 10:37:59 -0500
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [USN-898-1] gnome-screensaver vulnerability

===========================================================
Ubuntu Security Notice USN-898-1          February 10, 2010
gnome-screensaver vulnerability
CVE-2010-0414
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  gnome-screensaver               2.28.0-0ubuntu3.4

After a standard system upgrade you need to restart your session to effect
the necessary changes.

Details follow:

It was discovered that gnome-screensaver did not correctly handle monitor
hotplugging. An attacker with physical access could cause gnome-screensaver
to crash and gain access to the locked session.


Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4.diff.gz
      Size/MD5:    14438 df2eeb9fde262814316d3d909bcc29aa
    http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4.dsc
      Size/MD5:     1757 6aa4026ae6faa87f58a76d0def8220cb
    http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0.orig.tar.gz
      Size/MD5:  5069053 cdf328a0443a3cc30b4b2b36d9a99236

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4_amd64.deb
      Size/MD5:  4185932 a64b30c3d21a6914d1a2376c9b85c34d

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4_i386.deb
      Size/MD5:  4169482 988fb3a93243e21d863462a7ec9c4d71

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4_lpia.deb
      Size/MD5:  4170332 40dcb1fb1c203811b2c4c0895a9e22af

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4_powerpc.deb
      Size/MD5:  4179928 709de0a74df0c05f3605b30eae34edba

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.4_sparc.deb
      Size/MD5:  4178372 cc91e447b311c1f509cbcfbf635c92a6




Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)