PT-2010-2479 · Gnome+1 · Gnome-Screensaver+1

Chris Coulson + 1 · CVE-2010-0732 · Publicado 2010-03-19 · Atualizado 2023-08-03

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GTK+ versions prior to 2.18.5 gnome-screensaver versions prior to 2.28.1

Description The issue allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times, due to implicit paints on windows of type GDK WINDOW FOREIGN, which triggers an X error in certain circumstances.

Recommendations For GTK+ versions prior to 2.18.5, update to version 2.18.5 or later. For gnome-screensaver versions prior to 2.28.1, update to version 2.28.1 or later.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2010-0732

Produtos afetados

Gtk+

Gnome-Screensaver

Referências · 20

• https://t.me/cvenotify/55723 · Publicação no Telegram
• http://git.gnome.org/browse/gtk+/commit/?id=0748cf563d0d0d03001a62589f13be16a8ec06c1 · Correção
• http://heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-2-Update-928580.html · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2010:109 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-0732 · Nota de Segurança
• http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=565527 · Correção
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html · Aviso do Fabricante
• https://bugs.edge.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/446395 · Nota
• https://osv.dev/vulnerability/CVE-2010-0732 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/03/16/9 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-0732 · Aviso do Fabricante
• http://securityfocus.com/bid/38211 · Nota
• http://openwall.com/lists/oss-security/2010/03/05/2 · Correção
• http://openwall.com/lists/oss-security/2010/02/12/1 · Nota