CVE-2010-0732

gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.

• CWE-362

• http://ftp.gnome.org/pub/gnome/sources/gtk+/2.18/gtk+-2.18.5.newsVendor Advisory
• http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520Vendor Advisory
• http://git.gnome.org/browse/gnome-screensaver/commit/?id=ab08cc93f2dc6223c8c00bfa1ca4f2d89069dbe0Patch
• http://git.gnome.org/browse/gtk+/commit/?id=0748cf563d0d0d03001a62589f13be16a8ec06c1Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.htmlThird Party Advisory
• http://secunia.com/advisories/39317Broken Link
• http://www.heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-2-Update-928580.htmlThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:109Broken Link
• http://www.openwall.com/lists/oss-security/2010/02/12/1Mailing List
• http://www.openwall.com/lists/oss-security/2010/03/05/2Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2010/03/16/9Mailing List
• http://www.securityfocus.com/bid/38211Third Party Advisory, VDB Entry
• https://bugs.edge.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/446395Third Party Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=598476Issue Tracking, Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=565527Issue Tracking, Patch
• http://ftp.gnome.org/pub/gnome/sources/gtk+/2.18/gtk+-2.18.5.newsVendor Advisory
• http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520Vendor Advisory
• http://git.gnome.org/browse/gnome-screensaver/commit/?id=ab08cc93f2dc6223c8c00bfa1ca4f2d89069dbe0Patch
• http://git.gnome.org/browse/gtk+/commit/?id=0748cf563d0d0d03001a62589f13be16a8ec06c1Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.htmlThird Party Advisory
• http://secunia.com/advisories/39317Broken Link
• http://www.heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-2-Update-928580.htmlThird Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:109Broken Link
• http://www.openwall.com/lists/oss-security/2010/02/12/1Mailing List
• http://www.openwall.com/lists/oss-security/2010/03/05/2Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2010/03/16/9Mailing List
• http://www.securityfocus.com/bid/38211Third Party Advisory, VDB Entry
• https://bugs.edge.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/446395Third Party Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=598476Issue Tracking, Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=565527Issue Tracking, Patch

Published

Mar 19, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-0726Cross-site scripting (XSS) vulnerability in the tb-send.rb (…
• CVE-2010-0727The gfs2_lock function in the Linux kernel before 2.6.34-rc1…
• CVE-2010-0728smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support …
• CVE-2010-0729A certain Red Hat patch for the Linux kernel in Red Hat Ente…
• CVE-2010-0730The MMIO instruction decoder in the Xen hypervisor in the Li…
• CVE-2010-0731The gnutls_x509_crt_get_serial function in the GnuTLS librar…
• CVE-2010-0733Integer overflow in src/backend/executor/nodeHash.c in Postg…
• CVE-2010-0734content_encoding.c in libcurl 7.10.5 through 7.19.7, when zl…
• CVE-2010-0735Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2010-0736Cross-site scripting (XSS) vulnerability in the view_queryfo…
• CVE-2010-0737A missing permission check was found in The CLI in JBoss Ope…8
• CVE-2010-0738The JMX-Console web application in JBossAs in Red Hat JBoss …5.3