Additional Distro Versions Vuln to usn-2789-1

[Nick]

Not sure if you're aware, but I'm able to replicate usb-2789-1 on
$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=15.04
DISTRIB_CODENAME=vivid
DISTRIB_DESCRIPTION="Ubuntu 15.04"

Current release in vivid:
||/ Name Version Architecture Description
+++-======================-================-================-=================================================
ii xscreensaver 5.30-1ubuntu1 amd64 Screensaver daemon and frontend for X11

The bug page only lists 12.04LTS as being vulnerable.

I was able to reproduce by having a dual screen (desktop) setup, and unplugging the *secondary* (as according to display settings), whilst the xscreensaver password unlock dialog was open.

[Marc Deslauriers (mdeslaur)]

Yes, we're aware. In Ubuntu 15.04, xscreensaver is in Universe, which means it is community maintained and doesn't get official security updates.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Launchpad Janitor (janitor)]

[Expired for xscreensaver (Ubuntu) because there has been no activity for 60 days.]

[Tormod Volden (tormodvolden)]

There are patches available in the Debian bug tracker (5.15 is a bit different than the newer versions). I believe the issue is still present in Trusty, Vivid and Wily, although it has been fixed in Precise.