CVE-2015-8308 LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
HighCVSS 7.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lxdm(Debian:12) | < 0.5.3-1 | 0.5.3-1 |
| debian/lxdm(Debian:13) | < 0.5.3-1 | 0.5.3-1 |
| debian/lxdm(Debian:14) | < 0.5.3-1 | 0.5.3-1 |
| lxdm project lxdm | <= 0.5.1 | No fix listed |
References
- Debian Security Tracker CVE-2015-8308 vendor-advisory
- [oss-security] 20151120 Re: LXDM X authentication issues mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- bugs.debian.org issue-tracking