slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.

surf: cookie jar has read access from other local user

https://bugs.gentoo.org/showbug.cgi?id=401645

Jeroen Roovers 2012-01-31 17:23:28 UTC

1) In a terminal, I run slock & sleep 5; <some X app>' 2) After about 10 seconds, I press some keys that slock would interpret as a password. 3a) It does not allow me to use <some X app> - all keyboard controls are captured. 3b) Pointer device input is blocked - <some X app> cannot be controlled through the mouse. 4) Entering the correct password unlocks the screen and makes <some X app> focused and in the foreground.

The only harm I see here is a possible unwanted disclosure of the information that <some X app> happens to display at the time, but it's a vulnerability sure enough.