CVE-2009-3101

The CVE-2009-3101 issue affects xscreensaver (Gnome-XScreenSaver) on Sun Solaris 10 and OpenSolaris (snv_109–snv_122). Root cause: a regression in certain patches related to Trusted Extensions handling, leading to denial of service via screen locking (CPU consumption and console hang). Impact is ...

CVE-2009-3100

CVE-2009-3100 affects xscreensaver (Gnome-XScreenSaver) on Solaris 9/10, OpenSolaris snv_109–snv_122, and X11 6.4.1 on Solaris 8. The vulnerability stems from improper handling of Accessibility support, enabling a local user to cause a denial of service (system hang) by locking the screen and the...

CVE-2009-3100

xscreensaver aka Gnome-XScreenSaver in Sun Solaris 9 and 10, OpenSolaris snv109 through snv122, and X11 6.4.1 on Solaris 8 does not properly handle Accessibility support, which allows local users to cause a denial of service system hang by locking the screen and then attempting to launch an...

CVE-2009-3101

xscreensaver aka Gnome-XScreenSaver in Sun Solaris 10, and OpenSolaris snv109 through snv122, does not properly handle Trusted Extensions, which allows local users to cause a denial of service CPU consumption and console hang by locking the screen, related to a regression in certain Solaris and...

CVE-2009-2711

XScreenSaver in Sun Solaris 9 and 10, OpenSolaris before snv120, and X11 6.4.1 for Solaris 8, when the Xorg or Xnewt server is used, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different...

Design/Logic Flaw

XScreenSaver in Sun Solaris 9 and 10, OpenSolaris before snv120, and X11 6.4.1 for Solaris 8, when the Xorg or Xnewt server is used, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different...

CVE-2009-2711

CVE-2009-2711 details an XScreenSaver vulnerability in Sun Solaris 9/10 and related X11 servers (Solaris 8/9/10, OpenSolaris) where popup windows can be read by a physically proximate attacker even when the screen is locked (different from CVE-2009-1276). Connected sources show Solaris patch upda...

CVE-2009-2711

XScreenSaver in Sun Solaris 9 and 10, OpenSolaris before snv120, and X11 6.4.1 for Solaris 8, when the Xorg or Xnewt server is used, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different...

Sun Solaris XScreenSaver本地信息泄漏漏洞

Bugraq ID: 35733 CNCAN ID：CNCAN-2009072105 Sun Solaris是一款商业性质的操作系统。 Solaris XScreenSaver see xscreensaver1程序存在未明错误，本地攻击者可以利用漏洞读取敏感信息。 目前没有详细漏洞细节提供。 Sun Solaris 9x86 Sun Solaris 9 Sun Solaris 8x86 Sun Solaris 8 Sun Solaris 10x86 Sun Solaris 10 Sun OpenSolaris build snv99 Sun OpenSolaris build snv9...

xscreensaver 5.01 Arbitrary File Disclosure Symlink Attack Vulnerability

No description provided by source. xscreensaver local arbitrary file disclosure | symlink attack The �xscreensaver� program distributed normally with Xorg can be abused to disclose local files owned by other users also of the root account. Xscreensaver has the setuid bit on by default Example...

xscreensaver 5.01 - Arbitrary File Disclosure Symlink

xscreensaver local arbitrary file disclosure | symlink attack The �xscreensaver� program distributed normally with Xorg can be abused to disclose local files owned by other users also of the root account. Xscreensaver has the setuid bit on by default Example: Opensolaris The xscreensaver...

Oops! About xscreensaver 5.01

Hello list, Just to clarify, I tested some operating systems against the xscreensaver vulnerability I posted yesterday. It affects at least xscreensaver 5.01. It does not affect recent versions as reported by the Debian bug tracking people, this is confirmed. Sorry about not catching this. Best...

xscreensaver symbolic links vulnerability

It's possible to obtain content of any file via /.xscreensaver symlink...

xscreensaver Symlink Attack

xscreensaver local arbitrary file disclosure | symlink attack The ´xscreensaver´ program distributed normally with Xorg can be abused to disclose local files owned by other users also of the root account. Xscreensaver has the setuid bit on by default Example: Opensolaris The xscreensaver program...

Re: [Full-disclosure] Oops! About xscreensaver 5.01

Hmmm, sorry for flooding the list but it seems it doesnt even affect xscreensaver 5.01. I will investigate when the vuln when I have time and keep you informed. There has to be some strange conf on my Opensolaris : Best Regards, kcope 2009/7/6 Kingcope [email protected]: Hello list, Just to...

xscreensaver local arbitrary file disclosure | symlink attack

xscreensaver local arbitrary file disclosure | symlink attack The "xscreensaver" program distributed normally with Xorg can be abused to disclose local files owned by other users also of the root account. Xscreensaver has the setuid bit on by default Example: Opensolaris The xscreensaver program...

Sun Solaris 'xscreensaver(1)'信息泄漏漏洞

BUGTRAQ ID: 34421 CNCAN ID：CNCAN-2009040902 Sun Solaris是一款商业性质的操作系统。 Solaris XScreenSaver see xscreensaver1程序允许弹出窗口通过锁屏并显示，并泄漏敏感信息。受此漏洞影响的应用程序如Thunderbird，会通知用户通过弹出窗口显示新邮件。 Sun Solaris 9x86 Sun Solaris 9 Sun Solaris 8x86 Sun Solaris 8 Sun Solaris 10.0x86 Sun Solaris 10.0 Sun OpenSolaris build snv...

CVE-2009-1276

XScreenSaver in Sun Solaris 10 and OpenSolaris before snv109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail...

Design/Logic Flaw

XScreenSaver in Sun Solaris 10 and OpenSolaris before snv109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail...

CVE-2009-1276

XScreenSaver in Sun Solaris 10 and OpenSolaris before snv109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail...