CVE-2016-6866: Null Pointer Dereference
Published Feb 15, 2017
·Updated
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
Affected Software
3 affected components
Suckless Slock<=1.3
Fedoraproject Fedora=24
Fedoraproject Fedora=25
Remediation
Event History
Feb 15, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6866?
The severity of CVE-2016-6866 is considered to be high due to the potential for unauthorized access.
2
How does CVE-2016-6866 allow an attacker to bypass the lock?
CVE-2016-6866 allows an attacker to bypass the lock through invalid password hashes that lead to a NULL pointer dereference.
3
Which versions of slock are affected by CVE-2016-6866?
CVE-2016-6866 affects slock versions up to and including 1.3.
4
How can I mitigate the risk associated with CVE-2016-6866?
To mitigate the risk of CVE-2016-6866, it is recommended to upgrade to a patched version of slock.
5
Is CVE-2016-6866 specific to any operating system?
CVE-2016-6866 has been reported to affect Fedora versions 24 and 25.