Xscreensaver is a widely deployed screen-lock utility for Unix and Linux systems that provides the primary access-control gate on countless desktop and server sessions. The product's vulnerability signal centers on authentication mechanisms and miscellaneous implementation issues that affect its role as a security boundary between unattended systems and potential local attackers. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xscreensaver over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-2187HIGH xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resource | Nov 27, 2019 | 7.8 | 25 | NO | NO |
CVE-2021-31523HIGH The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges beca | Apr 21, 2021 | 7.8 | 23 | NO | NO |
CVE-2004-2655MEDIUM rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver start | Dec 31, 2004 | 5.4 | 20 | NO | NO |
CVE-2021-34557MEDIUM XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standa | Jun 10, 2021 | 4.6 | 18 | NO | NO |
CVE-2007-1859MEDIUM XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network | May 2, 2007 | 4.6 | 17 | NO | NO |
CVE-2003-0885MEDIUM Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecurely in the (1) apple2, (2) xanalogtv, an | Dec 31, 2003 | 6.4 | 17 | NO | NO |
CVE-2007-5585MEDIUM xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to | Oct 19, 2007 | 5.0 | 15 | NO | NO |
Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vid | Dec 31, 2003 | 2.1 | 13 | NO | NO |
driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot | Nov 10, 2015 | 2.1 | 11 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xscreensaver.
Media articles that mention a CVE ID that affects a product developed by Xscreensaver — matched by CVE ID, not by vendor name.