CVE-2014-1949 GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
HighCVSS 7.2
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cinnamon(Debian:12) | < 2.2.14-1 | 2.2.14-1 |
| debian/cinnamon(Debian:13) | < 2.2.14-1 | 2.2.14-1 |
| debian/cinnamon(Debian:14) | < 2.2.14-1 | 2.2.14-1 |
| debian/gtk+3.0(Debian:12) | < 3.11.8-1 | 3.11.8-1 |
| debian/gtk+3.0(Debian:13) | < 3.11.8-1 | 3.11.8-1 |
| debian/gtk+3.0(Debian:14) | < 3.11.8-1 | 3.11.8-1 |
| linuxmint linux mint | = 17.0 | No fix listed |
| GNOME gtk | <= 3.10.9 | No fix listed |
| Canonical Ubuntu | = 14.04 | No fix listed |
References
- Debian Security Tracker CVE-2014-1949 vendor-advisory
- advisories.mageia.org third-party-advisory
- [oss-security] 20140212 cinnamon-screensaver lock bypass (tested on Fedora 20) mailing-list third-party-advisory
- [oss-security] 20140212 Re: cinnamon-screensaver lock bypass (tested on Fedora 20) mailing-list third-party-advisory
- MDVSA-2015:162 broken-link vendor-advisory
- USN-2475-1 third-party-advisory vendor-advisory
- bugs.debian.org third-party-advisory
- bugzilla.redhat.com issue-tracking
- github.com third-party-advisory
- bugs.debian.org issue-tracking