Re: CVE id request: xscreensaver

[Tomas Hoger <thoger () redhat com>]

On Sun, 25 May 2008 18:29:13 +1000 Steffen Joeris
<steffen.joeris () skolelinux de> wrote:

> Pierre Habouzit discovered that resizing with the xrandr tool can
> crash xscreensaver.
>
> Debian Bug report:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=482385
>
> The tested version of xscreensaver is 5.05-1, but at the moment there
> is no reason to assume that the bug did not exist in previous
> versions.

Is there any known attack vector crossing trust boundary?  Usage of
xrandr should be fully under the control of the user running
xscreensaver.

-- 
Tomas Hoger / Red Hat Security Response Team