CVE-2011-2187

Published: Nov 27, 2019Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.

Affected (4)

Products: Xscreensaver Project: Xscreensaver · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xscreensaver Project Xscreensaver	Before 5.14

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (12)

https://access.redhat.com/security/cve/cve-2011-2187

Source: secalert@redhat.com

Third Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627382

Source: secalert@redhat.com

ExploitThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2187

Source: secalert@redhat.com

ExploitIssue TrackingThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2011-2187

Source: secalert@redhat.com

Third Party Advisory

https://www.jwz.org/xscreensaver/changelog.html

Source: secalert@redhat.com

Release NotesVendor Advisory

https://www.openwall.com/lists/oss-security/2011/06/06/17

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://access.redhat.com/security/cve/cve-2011-2187