suckless vulnerabilities

Products

• slock 2
• surf 1

Latest suckless CVEs

Newest publication first

1. CVE-2012-0842 surf: cookie jar has read access from other local user

   Published 2019-11-19

   Medium·CVSS 5.5 EPSS 0.38%

   surf: cookie jar has read access from other local user

2. CVE-2016-6866 slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.

   Published 2017-02-15

   High·CVSS 7.5 EPSS 2.9%

   slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.

3. CVE-2012-1620 slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveal...

   Published 2012-07-12

   Low·CVSS 3.6 EPSS 0.51%

   slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.