driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.

It was discovered that unplugging one of the monitors in a multi-monitor setup can cause xscreensaver to crash. Someone with physical access to a machine could use this problem to bypass a locked session.

The xscreensaver package was updated to fix the following security issue :

  - CVE-2015-8025: Fixed a crash when hot-swapping monitors     while locked (bsc#952062).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The xscreensaver package was updated to fix the following security and non security issues :

  - CVE-2015-8025: Fixed a crash when hot-swapping monitors     while locked (bsc#952062).

  - Added xscreensaver-in_signal_handler_p.patch needed for     fix of signal handling.

  - Refresh xscreensaver-stars.patch.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Xscreensaver was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-8025: xscreensaver could be bypassed by     disconnecting HDMI cable (bsc#952062).

It was discovered that XScreenSaver incorrectly handled unplugging an external monitor. An attacker with physical access could use this flaw to gain access to a locked session.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

xscreensaver, a screensaver daemon and frontend for X11 was vulnerable to crashing when hot-swapping monitors.

For Debian 6 Squeeze, this issue has been fixed in xscreensaver version 5.11-1+deb6u11.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

RedHat bugzilla reports :

In dual screen configurations, unplugging one screen will cause xscreensaver to crash, leaving the screen unlocked.

ID	Name	Product	Family	Severity
87851	Debian DSA-3438-1 : xscreensaver - security update	Nessus	Debian Local Security Checks	low
87720	SUSE SLED12 / SLES12 Security Update : xscreensaver (SUSE-SU-2015:2053-2)	Nessus	SuSE Local Security Checks	low
87008	SUSE SLED11 / SLES11 Security Update : xscreensaver (SUSE-SU-2015:2054-1)	Nessus	SuSE Local Security Checks	low
87007	SUSE SLED12 / SLES12 Security Update : xscreensaver (SUSE-SU-2015:2053-1)	Nessus	SuSE Local Security Checks	low
86965	openSUSE Security Update : xscreensaver (openSUSE-2015-783)	Nessus	SuSE Local Security Checks	low
86720	Ubuntu 12.04 LTS : xscreensaver vulnerability (USN-2789-1)	Nessus	Ubuntu Local Security Checks	low
86677	Debian DLA-338-1 : xscreensaver security update	Nessus	Debian Local Security Checks	low
86621	FreeBSD : xscreensaver - lock bypass (4b9393b8-7c0c-11e5-a010-080027ddead3)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2015-8025

critical

Tenable Plugins

low

low

low

low

low

low

low

low