{"id":"CVE-2021-34557","aliases":["ALPINE-CVE-2021-34557","DEBIAN-CVE-2021-34557","EUVD-2021-21207","GHSA-hrwv-325w-f6ch","MGASA-2021-0278","SUSE-SU-2022:2641-1","SUSE-SU-2022:2642-1","UBUNTU-CVE-2021-34557"],"status":"published","title":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs....","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0048,"percentile":0.41849,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2021-06-10T15:54:35Z","modified":"2026-11-03T06:32:47Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xscreensaver","fixed_in":["6.02-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xscreensaver","fixed_in":["5.45+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xscreensaver","fixed_in":["5.45+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xscreensaver","fixed_in":["5.45+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"xscreensaver","fixed_in":["5.45-1.4.mga8","5.45-1.4.mga8.tainted"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"xscreensaver","fixed_in":["5.44-150000.5.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"xscreensaver","fixed_in":["5.44-150000.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xscreensaver","fixed_in":["5.22-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xscreensaver","fixed_in":["5.22-8.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.02-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45+dfsg1-2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45-1.4.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45-1.4.mga8.tainted"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-150000.5.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.44-150000.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22-8.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.30-1ubuntu1","5.34-1ubuntu1","5.34-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.36-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.42+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xscreensaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.45+dfsg1-2ubuntu1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"xscreensaver_project","product":"xscreensaver"}],"references":[{"url":"https://github.com/QubesOS/qubes-issues/issues/6595","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/06/05/1","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/06/11/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/07/06/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34557"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/"},{"url":"https://github.com/advisories/GHSA-hrwv-325w-f6ch"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-34557","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-34557","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0278.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29086","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/06/11/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222641-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186918","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-34557","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222642-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-34557","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/06/05/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34557","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-34557","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T15:54:35Z","modified":"2024-08-04T00:12:50.416Z","updated_at":"2026-11-02T14:33:11.244759Z"}],"euvd":[{"id":"EUVD-2021-21207","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T15:54:35Z","modified":"2024-08-04T00:12:50Z","updated_at":"2026-11-03T03:24:32.445199Z"}],"ghsa":[{"id":"GHSA-hrwv-325w-f6ch","title":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs....","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2022-05-24T19:04:51Z","modified":"2023-01-29T05:06:57Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:46:07.768849Z"}],"nvd":[{"id":"CVE-2021-34557","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T16:15:08.227Z","modified":"2026-06-17T03:56:07.123Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"ALPINE-CVE-2021-34557","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T16:15:08.227Z","modified":"2026-11-03T06:32:47.572889963Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-34557","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T16:15:08.227Z","modified":"2026-04-16T04:35:19.15604255Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-34557","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T16:15:08.227Z","modified":"2026-10-23T18:03:15.109878794Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-34557","description":"XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.","status":"published","published":"2021-06-10T16:15:00Z","modified":"2025-10-24T04:50:24Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"MGASA-2021-0278","title":"Updated xscreensaver packages fix security vulnerability","description":"An issue allowing to cause crash and locked screen bypass (CVE-2021-34557).\n","status":"published","published":"2021-06-23T17:11:28Z","modified":"2026-04-16T04:43:21.929981647Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"SUSE-SU-2022:2641-1","title":"Security update for xscreensaver","description":"This update for xscreensaver fixes the following issues:\n\n- CVE-2021-34557: Fixed potential crash and unlock while disconnecting video output with more than 10 monitors (bsc#1186918)\n","status":"published","published":"2022-08-03T09:37:47Z","modified":"2026-02-04T02:54:39.12366Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2642-1","title":"Security update for xscreensaver","description":"This update for xscreensaver fixes the following issues:\n\n- CVE-2021-34557: Fixed potential crash and unlock while disconnecting video output with more than 10 monitors (bsc#1186918)\n","status":"published","published":"2022-08-03T09:38:05Z","modified":"2026-02-04T02:53:46.904942Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}