CVE-2021-34557

XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs.

• CWE-120

• http://www.openwall.com/lists/oss-security/2021/06/11/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/07/06/2Exploit, Mailing List, Third Party Advisory
• https://github.com/QubesOS/qubes-issues/issues/6595Issue Tracking, Third Party Advisory
• https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txtExploit, Third Party Advisory
• https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patchPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/
• https://www.openwall.com/lists/oss-security/2021/06/05/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/06/11/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/07/06/2Exploit, Mailing List, Third Party Advisory
• https://github.com/QubesOS/qubes-issues/issues/6595Issue Tracking, Third Party Advisory
• https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txtExploit, Third Party Advisory
• https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patchPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/
• https://www.openwall.com/lists/oss-security/2021/06/05/1Exploit, Mailing List, Third Party Advisory

Published

Jun 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34550An issue was discovered in Tor before 0.4.6.5, aka TROVE-202…7.5
• CVE-2021-34551PHPMailer before 6.5.0 on Windows allows remote code executi…8.1
• CVE-2021-34552Pillow through 8.2.0 and PIL (aka Python Imaging Library) th…9.8
• CVE-2021-34553Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a…4.3
• CVE-2021-34555OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause…7.5
• CVE-2021-34556In the Linux kernel through 5.13.7, an unprivileged BPF prog…5.5
• CVE-2021-34558The crypto/tls package of Go through 1.16.5 does not properl…6.5
• CVE-2021-34559In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerabili…5.3
• CVE-2021-3456An improper authorization handling flaw was found in Foreman…7.1
• CVE-2021-34560In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contai…5.5
• CVE-2021-34561In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue…8.8
• CVE-2021-34562In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible t…6.1