CVE-2010-0422

Description

gnome-screensaver 2.28.x before 2.28.3 does not properly synchronize the state of screen locking and the unlock dialog in situations involving a change to the number of monitors, which allows physically proximate attackers to bypass screen locking and access an unattended workstation by connecting and disconnecting monitors multiple times, a related issue to CVE-2010-0414.

4.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.08%

Vendor Advisory fedoraproject.org Vendor Advisory secunia.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=564464
https://bugzilla.gnome.org/show_bug.cgi?id=609789
http://marc.info/?l=oss-security&m=126601292400764&w=2	mailing list
http://ftp.gnome.org/pub/GNOME/sources/gnome-screensaver/2.28/gnome-screensaver-2.28.3.news
https://exchange.xforce.ibmcloud.com/vulnerabilities/56364	vdb entry
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035115.html	vendor advisory
http://secunia.com/advisories/38565	third party advisory vendor advisory
http://git.gnome.org/browse/gnome-screensaver/commit/?id=d4dcbd65a2df3c093c4e3a74bbbc75383eb9eadb
http://secunia.com/advisories/38583	third party advisory vendor advisory
http://git.gnome.org/browse/gnome-screensaver/commit/?id=271ae93d7b140b8ba40d77f9e4ce894e5fd1b554
http://www.securityfocus.com/bid/38248	vdb entry
http://git.gnome.org/browse/gnome-screensaver/commit/?id=f93a22c175090cf02e80bc3ee676b53f1251f685

Frequently Asked Questions

What is the severity of CVE-2010-0422?: CVE-2010-0422 has been scored as a medium severity vulnerability.
How to fix CVE-2010-0422?: To fix CVE-2010-0422, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2010-0422 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2010-0422 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.