Описание
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| suckless-tools | fixed | 41-1 | package | |
| suckless-tools | fixed | 40-1+deb8u2 | jessie | package |
Примечания
https://www.openwall.com/lists/oss-security/2016/08/18/22
http://s1m0n.dft-labs.eu/files/slock/
Starting with 41-1 slock.c got patched to use PAM, cf. #739629
and with the patch readpw(dpy, pws) is not called anymore, and
thus in readpw, not calling crypt(passwd, pws) with a possibly
empty pws.
EPSS
Связанные уязвимости
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
EPSS