4.6med
CVE-2016-10894
xtrlock through 2.10 does not block multitouch events.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.6
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 30%
Public exploits
0
none known
Summary
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
Exploit prediction (EPSS)
0.36% probability of exploitation in the next 30 days, higher than 30% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:N/I:P/A:N |
Classification
- Weakness
- CWE-254 7PK - Security Features
References
- bugs.debian.org /830726 · x_refsource_MISC, x_transferred
- lists.debian.org /debian-lts-announce/2019/10/msg00019.html · mailing-list, x_refsource_MLIST, x_transferred
Sources
- CVE List: CVE-2016-10894
- NVD: CVE-2016-10894
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.