CVE-2016-10894

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
References
Link Resource
https://bugs.debian.org/830726 Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html Mailing List Third Party Advisory
https://bugs.debian.org/830726 Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xtrlock_project:xtrlock:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

History

21 Nov 2024, 02:45

Type Values Removed Values Added
References () https://bugs.debian.org/830726 - Issue Tracking, Patch, Third Party Advisory () https://bugs.debian.org/830726 - Issue Tracking, Patch, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html - Mailing List, Third Party Advisory

Information

Published : 2019-08-16 03:15

Updated : 2024-11-21 02:45


NVD link : CVE-2016-10894

Mitre link : CVE-2016-10894

CVE.ORG link : CVE-2016-10894


JSON object : View

Products Affected

debian

  • debian_linux

xtrlock_project

  • xtrlock
CWE
CWE-254

7PK - Security Features