Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
198
security advisoryupdatemedium severityArch Linux: 202311-01 Critical: Gnome Shell Session Vulnerability Exploit
The package slock before version 1.4-2 is vulnerable to access restriction bypass. . Arch Linux Security Advisory ASA-201611-21 ========================================= Severity: Medium Date : 2016-11-21 CVE-ID : CVE-2016-6866 Package : slock Type : access restriction bypass Remote : No Link : https://wiki.archlinux.org/title/CVE Summary ====== The package slock before version 1.4-2 is vulnerable to access restriction bypass. Resolution ========= Upgrade to 1.4-2. # pacman -Syu "slock> =1.4-2" The problem has been fixed upstream in version 1.4. Workaround ========= None. Description ========== A null pointer dereference vulnerability has been discovered in the screen locking application slock. It calls crypt(3) and uses the return value for strcmp(3) without checking to see if the return value of crypt(3) was a NULL pointer. If the hash returned by (getspnam()-> sp_pwdp) is invalid, crypt(3) will return NULL and set errno to EINVAL. This will cause slock to segfault which then leaves the machine unprotected. A couple of common scenarios where this might happen are: - a machine using NSS for authentication; on the machine this bug was discovered, (getspnam()-> sp_pwdp) returns "*". - the user's account has been disabled for one reason or another; maybe account expiry or password expiry. Impact ===== A local attacker might be able to bypass access restrictions when locking the screen fails under certain circumstances. References ========= https://seclists.org/oss-sec/2016/q3/333 https://access.redhat.com/security/cve/CVE-2016-6866 . Arch Linux Security Notice resolving slock access control vulnerability categorized as Medium risk, update suggested.. slock security issues, Arch Linux updates, access restriction vulnerability. . Severity: Medium. LinuxSecurity.com Team
Nov 21, 2016
•Medium
ArchLinux
89
security advisorymoderateFedoraFedora 23: 2016-7e817cbf55 Moderate: slock Crash Due To Invalid Hash
This release fixes CVE-2016-6866, a crash when verifying a password for a user without a valid shadow hash entry.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-7e817cbf55 2016-09-09 16:20:23.689401 -------------------------------------------------------------------------------- Name : slock Product : Fedora 23 Version : 1.3 Release : 2.fc23 URL : http://tools.suckless.org/slock/ Summary : Simple X display locker Description : This is the simplest X screen locker we are aware of. It is stable and quite a lot people in this community are using it every day when they are out with friends or fetching some food from the local pub. -------------------------------------------------------------------------------- Update Information: This release fixes CVE-2016-6866, a crash when verifying a password for a user without a valid shadow hash entry. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1368369 - CVE-2016-6866 slock: Null pointer dereference results in segmentation fault https://bugzilla.redhat.com/show_bug.cgi?id=1368369 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update slock' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 09, 2016
•Important
Fedora
89
security advisoryfedorasoftware updateFedora 24: slock Crash Fix Advisory for Shadow Hash Issue
This release fixes CVE-2016-6866, a crash when verifying a password for a user without a valid shadow hash entry.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-985b68721b 2016-09-09 16:20:18.939263 -------------------------------------------------------------------------------- Name : slock Product : Fedora 24 Version : 1.3 Release : 2.fc24 URL : http://tools.suckless.org/slock/ Summary : Simple X display locker Description : This is the simplest X screen locker we are aware of. It is stable and quite a lot people in this community are using it every day when they are out with friends or fetching some food from the local pub. -------------------------------------------------------------------------------- Update Information: This release fixes CVE-2016-6866, a crash when verifying a password for a user without a valid shadow hash entry. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1368369 - CVE-2016-6866 slock: Null pointer dereference results in segmentation fault https://bugzilla.redhat.com/show_bug.cgi?id=1368369 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update slock' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 09, 2016
•Critical
Fedora
89
security advisoryFedoracrash fixFedora 36: FEDORA-2023-7c2b21f6b4 high: xorg-server Buffer Overflow
This release fixes CVE-2016-6866, a crash when verifying a password for a user without a valid shadow hash entry.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-1b7e66c08b 2016-09-05 17:51:00.341573 -------------------------------------------------------------------------------- Name : slock Product : Fedora 25 Version : 1.3 Release : 2.fc25 URL : http://tools.suckless.org/slock/ Summary : Simple X display locker Description : This is the simplest X screen locker we are aware of. It is stable and quite a lot people in this community are using it every day when they are out with friends or fetching some food from the local pub. -------------------------------------------------------------------------------- Update Information: This release fixes CVE-2016-6866, a crash when verifying a password for a user without a valid shadow hash entry. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1368369 - CVE-2016-6866 slock: Null pointer dereference results in segmentation fault https://bugzilla.redhat.com/show_bug.cgi?id=1368369 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update slock' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 05, 2016
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!