Description of problem:

Quoting Debian bug report: With the addition of the feature to send a message to the logged in user when they return and unlock a locked session, this gives local attackers the ability to read the X selection and clipboard buffers with a middle click on the mouse and a Ctrl+V. I note that the box to leave a message doesn't have a context menu that you could paste via, but it doesn't go far enough.

Additional info:

http://bugzilla.gnome.org/showbug.cgi?id=503005 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=455484