CVE-2016-10894

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
References
Link Resource
https://bugs.debian.org/830726 Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xtrlock_project:xtrlock:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-08-16 03:15

Updated : 2024-02-28 17:08


NVD link : CVE-2016-10894

Mitre link : CVE-2016-10894

CVE.ORG link : CVE-2016-10894


JSON object : View

Products Affected

xtrlock_project

  • xtrlock

debian

  • debian_linux
CWE
CWE-254

7PK - Security Features