diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 0248f8cbc270..58f027354575 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,43 @@ Note: Please add new entries to the beginning of this file. --> + + xlockmore -- local exploit + + + xlockmore + ja-xlockmore + 5.40_1 + + + + +

Ignatios Souvatzis of NetBSD reports:

+
+

localtime accesses a (in the discovered case) 64bit value, which + is likely not to be valid, and returns a null pointer as an error + indication. The code in dclock.c does not check for this but, + depending on additional command-line options, either dereferences + the pointer or passes it to strftime() unconditionally, which in + turn triggers a segmentation fault, terminating the program and + leaving the terminal unlocked.

+

While this is unexpected, the dangerous case is where + "xlockmore -mode random" calls the mode "dclock" after a while, + when the user has left the terminal, not noticing that it will + (eventually) be unlocked.

+
+ + + + CVE-2012-4524 + http://www.openwall.com/lists/oss-security/2012/10/17/10 + + + 2012-10-17 + 2012-10-17 + + + xinetd -- attackers can bypass access restrictions if tcpmux-servers service enabled