Debian LTS: DLA-1959-1: xtrlock security update

    Date14 Oct 2019
    CategoryDebian LTS
    352
    Posted ByLinuxSecurity Advisories
    Debianlts Large
    It was discovered that multitouch devices were not being disabled by the "xtrlock" screen locking utility. xtrlock did not block multitouch events so an attacker could still
    
    Package        : xtrlock
    Version        : 2.6+deb8u1
    CVE ID         : CVE-2016-10894
    Debian Bug     : #830726
    
    It was discovered that multitouch devices were not being disabled
    by the "xtrlock" screen locking utility.
    
    xtrlock did not block multitouch events so an attacker could still
    input and thus control various programs such as Chromium, etc. via
    so-called "multitouch" events including pan scrolling, "pinch and
    zoom" or even being able to provide regular mouse clicks by
    depressing the touchpad once and then clicking with a secondary
    finger.
    
    For Debian 8 "Jessie", this issue has been fixed in xtrlock version
    2.6+deb8u1. However, this fix does not the situation where an
    attacker plugs in a multitouch device *after* the screen has been
    locked. For more information on this, please see:
    
      https://bugs.debian.org/830726#115
    
    We recommend that you upgrade your xtrlock packages pending a
    deeper fix.
    
    
    Regards,
    
    - -- 
          ,''`.
         : :'  :     Chris Lamb
         `. `'`      This email address is being protected from spambots. You need JavaScript enabled to view it. / chris-lamb.co.uk
           `-
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"39","type":"x","order":"1","pct":50.65,"resources":[]},{"id":"88","title":"Should be more technical","votes":"11","type":"x","order":"2","pct":14.29,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"27","type":"x","order":"3","pct":35.06,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.