From owner-svn-ports-head@FreeBSD.ORG Thu Oct 18 04:13:28 2012 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id E5D2DE63; Thu, 18 Oct 2012 04:13:28 +0000 (UTC) (envelope-from jgh@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id CE6D28FC0C; Thu, 18 Oct 2012 04:13:28 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q9I4DSIC041299; Thu, 18 Oct 2012 04:13:28 GMT (envelope-from jgh@svn.freebsd.org) Received: (from jgh@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q9I4DS2s041297; Thu, 18 Oct 2012 04:13:28 GMT (envelope-from jgh@svn.freebsd.org) Message-Id: <201210180413.q9I4DS2s041297@svn.freebsd.org> From: Jason Helfman Date: Thu, 18 Oct 2012 04:13:28 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r306051 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Oct 2012 04:13:29 -0000 Author: jgh Date: Thu Oct 18 04:13:27 2012 New Revision: 306051 URL: http://svn.freebsd.org/changeset/ports/306051 Log: - clarify end-user impact for 57652765-18aa-11e2-8382-00a0d181e71d Suggested by: simon@ Feature safe: yes Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Oct 18 02:10:10 2012 (r306050) +++ head/security/vuxml/vuln.xml Thu Oct 18 04:13:27 2012 (r306051) @@ -64,17 +64,10 @@ Note: Please add new entries to the beg

Ignatios Souvatzis of NetBSD reports:

-
localtime accesses a (in the discovered case) 64bit value, which - is likely not to be valid, and returns a null pointer as an error - indication. The code in dclock.c does not check for this but, - depending on additional command-line options, either dereferences - the pointer or passes it to strftime() unconditionally, which in - turn triggers a segmentation fault, terminating the program and - leaving the terminal unlocked.
-
While this is unexpected, the dangerous case is where - "xlockmore -mode random" calls the mode "dclock" after a while, - when the user has left the terminal, not noticing that it will - (eventually) be unlocked.
+
Due to an error in the dclock screensaver in xlockmore, users who + explicitly use this screensaver or a random mix of screensavers using + something like "xlockmore -mode random" may have their screen unlocked + unexpectedly at a random time.