CVE-2007-6389
First published: Wed Dec 12 2007(Updated: )
Description of problem: Quoting Debian bug report: With the addition of the feature to send a message to the logged in user when they return and unlock a locked session, this gives local attackers the ability to read the X selection and clipboard buffers with a middle click on the mouse and a Ctrl+V. I note that the box to leave a message doesn't have a context menu that you could paste via, but it doesn't go far enough. Additional info: <a href="http://bugzilla.gnome.org/show_bug.cgi?id=503005">http://bugzilla.gnome.org/show_bug.cgi?id=503005</a> <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455484">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455484</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNOME screensaver | =2.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugzilla.gnome.org/show_bug.cgi?id=503005
- https://bugzilla.redhat.com/show_bug.cgi?id=421461
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455484
- https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/146862
- http://secunia.com/advisories/29595
- https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00020.html
- https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00078.html
- http://secunia.com/advisories/29666
- http://www.securityfocus.com/bid/30096
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:135
- http://bugzilla.gnome.org/show_bug.cgi?id=482159
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
- http://secunia.com/advisories/31687
- http://www.ubuntu.com/usn/USN-669-1
- http://secunia.com/advisories/32691
- https://admin.fedoraproject.org/updates/F7/FEDORA-2008-2818
- https://admin.fedoraproject.org/updates/F8/FEDORA-2008-2872
- collector/nvd-historical
- collector/nvd-index
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- agent/type
- agent/event
- agent/author
- agent/severity
- agent/description
- agent/references
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2007-6389
- vendor/gnome
- canonical/gnome screensaver
- version/gnome screensaver/2.20