http://advisories.mageia.org/MGASA-2014-0374.html

[oss-security] 20140212 cinnamon-screensaver lock bypass (tested on Fedora 20)

[oss-security] 20140212 Re: cinnamon-screensaver lock bypass (tested on Fedora 20)

MDVSA-2015:162

USN-2475-1

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759145

https://bugzilla.redhat.com/show_bug.cgi?id=1064695

https://github.com/linuxmint/cinnamon-screensaver/issues/44

Updated gtk+3.0 packages fix security vulnerability :

Clemens Fries reported that, when using Cinnamon, it was possible to bypass the screensaver lock. An attacker with physical access to the machine could use this flaw to take over the locked desktop session (CVE-2014-1949).

This was fixed by including a patch for the root cause of the issue in gtk+3.0, which came from the implementation of popup menus in GtkWindow (bgo#722106).

This update also includes other patches from upstream to fix bugs affecting GtkFileChooser (bgo#386569, bgo#719977) and GtkSpinButton (bgo#709491), and a crash related to clipboard handling (bgo#719314).

This update fixes an issue that could lead to opening a cascade of menus on top of menus when holding down the menu key.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82415	Mandriva Linux Security Advisory : gtk+3.0 (MDVSA-2015:162)	Nessus	Mandriva Local Security Checks	high
77429	Fedora 20 : gtk3-3.10.9-2.fc20 (2014-9794)	Nessus	Fedora Local Security Checks	high

CVE-2014-1949

high

Tenable Plugins

high

high