{"id":"UBUNTU-CVE-2021-34557","details":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","modified":"2025-10-24T04:50:24Z","published":"2021-06-10T16:15:00Z","upstream":["CVE-2021-34557"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-34557"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2021/06/05/1"},{"type":"REPORT","url":"https://www.openwall.com/lists/oss-security/2021/06/05/2"},{"type":"REPORT","url":"https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch"},{"type":"REPORT","url":"https://github.com/QubesOS/qubes-issues/issues/6595"},{"type":"REPORT","url":"https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-34557"}],"affected":[{"package":{"name":"xscreensaver","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/xscreensaver@5.34-2ubuntu1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.30-1ubuntu1","5.34-1ubuntu1","5.34-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"xscreensaver","binary_version":"5.34-2ubuntu1"},{"binary_version":"5.34-2ubuntu1","binary_name":"xscreensaver-data"},{"binary_name":"xscreensaver-data-extra","binary_version":"5.34-2ubuntu1"},{"binary_name":"xscreensaver-gl","binary_version":"5.34-2ubuntu1"},{"binary_name":"xscreensaver-gl-extra","binary_version":"5.34-2ubuntu1"},{"binary_name":"xscreensaver-screensaver-bsod","binary_version":"5.34-2ubuntu1"},{"binary_name":"xscreensaver-screensaver-webcollage","binary_version":"5.34-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-34557.json"}},{"package":{"name":"xscreensaver","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/xscreensaver@5.36-1ubuntu1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.36-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"xscreensaver","binary_version":"5.36-1ubuntu1"},{"binary_name":"xscreensaver-data","binary_version":"5.36-1ubuntu1"},{"binary_name":"xscreensaver-data-extra","binary_version":"5.36-1ubuntu1"},{"binary_name":"xscreensaver-gl","binary_version":"5.36-1ubuntu1"},{"binary_name":"xscreensaver-gl-extra","binary_version":"5.36-1ubuntu1"},{"binary_name":"xscreensaver-screensaver-bsod","binary_version":"5.36-1ubuntu1"},{"binary_name":"xscreensaver-screensaver-webcollage","binary_version":"5.36-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-34557.json"}},{"package":{"name":"xscreensaver","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/xscreensaver@5.42+dfsg1-1ubuntu1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.42+dfsg1-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"xscreensaver","binary_version":"5.42+dfsg1-1ubuntu1"},{"binary_name":"xscreensaver-data","binary_version":"5.42+dfsg1-1ubuntu1"},{"binary_name":"xscreensaver-data-extra","binary_version":"5.42+dfsg1-1ubuntu1"},{"binary_name":"xscreensaver-gl","binary_version":"5.42+dfsg1-1ubuntu1"},{"binary_name":"xscreensaver-gl-extra","binary_version":"5.42+dfsg1-1ubuntu1"},{"binary_name":"xscreensaver-screensaver-bsod","binary_version":"5.42+dfsg1-1ubuntu1"},{"binary_name":"xscreensaver-screensaver-webcollage","binary_version":"5.42+dfsg1-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-34557.json"}},{"package":{"name":"xscreensaver","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/xscreensaver@5.45+dfsg1-2ubuntu1?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.45+dfsg1-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"xscreensaver","binary_version":"5.45+dfsg1-2ubuntu1"},{"binary_name":"xscreensaver-data","binary_version":"5.45+dfsg1-2ubuntu1"},{"binary_name":"xscreensaver-data-extra","binary_version":"5.45+dfsg1-2ubuntu1"},{"binary_name":"xscreensaver-gl","binary_version":"5.45+dfsg1-2ubuntu1"},{"binary_name":"xscreensaver-gl-extra","binary_version":"5.45+dfsg1-2ubuntu1"},{"binary_name":"xscreensaver-screensaver-bsod","binary_version":"5.45+dfsg1-2ubuntu1"},{"binary_name":"xscreensaver-screensaver-webcollage","binary_version":"5.45+dfsg1-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-34557.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}