DebianDEBIAN:DLA-1959-1:0F5CF[SECURITY] [DLA 1959-1] xtrlock security update
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
4.6 Medium
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
34.8%
Package : xtrlock
Version : 2.6+deb8u1
CVE ID : CVE-2016-10894
Debian Bug : #830726
It was discovered that multitouch devices were not being disabled
by the "xtrlock" screen locking utility.
xtrlock did not block multitouch events so an attacker could still
input and thus control various programs such as Chromium, etc. via
so-called "multitouch" events including pan scrolling, "pinch and
zoom" or even being able to provide regular mouse clicks by
depressing the touchpad once and then clicking with a secondary
finger.
For Debian 8 "Jessie", this issue has been fixed in xtrlock version
2.6+deb8u1. However, this fix does not the situation where an
attacker plugs in a multitouch device after the screen has been
locked. For more information on this, please see:
https://bugs.debian.org/830726#115
We recommend that you upgrade your xtrlock packages pending a
deeper fix.
Regards,
,''`.
: :' : Chris Lamb
`. `'` [email protected] / chris-lamb.co.uk
`-
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 9 | mipsel | xtrlock | < 2.8+deb9u1+b1 | xtrlock_2.8+deb9u1+b1_mipsel.deb |
| Debian | 9 | arm64 | xtrlock | < 2.8+deb9u1+b1 | xtrlock_2.8+deb9u1+b1_arm64.deb |
| Debian | 9 | armhf | xtrlock | < 2.8+deb9u1+b1 | xtrlock_2.8+deb9u1+b1_armhf.deb |
| Debian | 9 | amd64 | xtrlock | < 2.8+deb9u1+b1 | xtrlock_2.8+deb9u1+b1_amd64.deb |
| Debian | 10 | mipsel | xtrlock | < 2.8+deb10u1+b1 | xtrlock_2.8+deb10u1+b1_mipsel.deb |
| Debian | 10 | mips64el | xtrlock | < 2.8+deb10u1+b1 | xtrlock_2.8+deb10u1+b1_mips64el.deb |
| Debian | 9 | i386 | xtrlock | < 2.8+deb9u1+b1 | xtrlock_2.8+deb9u1+b1_i386.deb |
| Debian | 9 | mips64el | xtrlock | < 2.8+deb9u1+b1 | xtrlock_2.8+deb9u1+b1_mips64el.deb |
| Debian | 10 | all | xtrlock | < 2.8+deb10u1 | xtrlock_2.8+deb10u1_all.deb |
| Debian | 9 | all | xtrlock | < 2.8+deb9u1 | xtrlock_2.8+deb9u1_all.deb |
Related
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
4.6 Medium
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
34.8%