GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2003-1294

Vulnerability from fkie_nvd - Published: 2003-12-31 05:00 - Updated: 2026-06-16 22:03
Severity
Summary
Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack.
References
secalert@redhat.comftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
secalert@redhat.comhttp://jwz.livejournal.com/310943.html
secalert@redhat.comhttp://secunia.com/advisories/20224
secalert@redhat.comhttp://secunia.com/advisories/20226
secalert@redhat.comhttp://secunia.com/advisories/20456
secalert@redhat.comhttp://secunia.com/advisories/20782
secalert@redhat.comhttp://support.avaya.com/elmodocs2/security/ASA-2006-107.htm
secalert@redhat.comhttp://www.novell.com/linux/download/updates/90_i386.html
secalert@redhat.comhttp://www.redhat.com/support/errata/RHSA-2006-0498.html
secalert@redhat.comhttp://www.securityfocus.com/bid/9125
secalert@redhat.comhttp://www.vupen.com/english/advisories/2006/1948
secalert@redhat.comhttps://bugzilla.redhat.com/bugzilla/attachment.cgi?id=124968
secalert@redhat.comhttps://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10848
af854a3a-2127-422b-91ae-364da2661108ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc
af854a3a-2127-422b-91ae-364da2661108http://jwz.livejournal.com/310943.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20224
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20226
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20456
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/20782
af854a3a-2127-422b-91ae-364da2661108http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/download/updates/90_i386.html
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2006-0498.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/9125
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/1948
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=124968
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10848
Impacted products
Vendor Product Version
xscreensaver xscreensaver 4.05_5cl
xscreensaver xscreensaver 4.05_6
xscreensaver xscreensaver 4.05_6a
xscreensaver xscreensaver 4.05_150
xscreensaver xscreensaver 4.07_2
xscreensaver xscreensaver 4.08_29135cl
xscreensaver xscreensaver 4.09_0
xscreensaver xscreensaver 4.10_4
xscreensaver xscreensaver 4.10_6
xscreensaver xscreensaver 4.10_8
xscreensaver xscreensaver 4.10_15
xscreensaver xscreensaver 4.11_0
xscreensaver xscreensaver 4.12_58
xscreensaver xscreensaver 4.12_62
xscreensaver xscreensaver 4.14_0
xscreensaver xscreensaver 4.14_2
xscreensaver xscreensaver 4.14_4
xscreensaver xscreensaver 4.14_5
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.05_5cl:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0ACB9D5-20EC-435E-8D92-49889AF2109F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.05_6:*:*:*:*:*:*:*",
              "matchCriteriaId": "48ED7D91-7B4C-45E2-85A9-F12715B34C76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.05_6a:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5CA791C-782A-46D6-B251-94E34A96CD6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.05_150:*:*:*:*:*:*:*",
              "matchCriteriaId": "7BA9A3F4-41C6-4547-9BBF-09DEA989E4DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.07_2:*:*:*:*:*:*:*",
              "matchCriteriaId": "001A7F4F-BE57-43BB-AD0A-B2427666C759",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.08_29135cl:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3EE3863-6F29-4619-A4D3-97C03EF82C6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.09_0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1569862E-DCFE-4E41-9D90-7230DDB59AFF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.10_4:*:*:*:*:*:*:*",
              "matchCriteriaId": "03253C48-1A1A-42E0-81C9-87992130E4A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.10_6:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BDE0728-2A04-4B83-AFB0-E72CE253C317",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.10_8:*:*:*:*:*:*:*",
              "matchCriteriaId": "D439805D-7CBD-4474-9732-5DF47588AAB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.10_15:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEF0095A-D406-414F-AB9F-BD33296103F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.11_0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A838D38-29AB-4464-B83B-07692AE08BB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.12_58:*:*:*:*:*:*:*",
              "matchCriteriaId": "576F9650-189E-442D-B6C4-FA7D27CF9210",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.12_62:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB85F56C-C841-490C-A499-CF886E61D332",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.14_0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2DA9C9E-BABB-4869-8643-4A7D64189653",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.14_2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3DCD6896-8791-4051-B928-8F623329B3CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.14_4:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA465E5C-BCAD-4775-BAA0-3EE8044E1D7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xscreensaver:xscreensaver:4.14_5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F94C3E0-6A5D-4CAC-A481-2BA653A028C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack."
    }
  ],
  "id": "CVE-2003-1294",
  "lastModified": "2026-06-16T22:03:52.773",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2003-12-31T05:00:00.000",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://jwz.livejournal.com/310943.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/20224"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/20226"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/20456"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/20782"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.novell.com/linux/download/updates/90_i386.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0498.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/9125"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2006/1948"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=124968"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10848"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jwz.livejournal.com/310943.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/20224"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/20226"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/20456"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/20782"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/download/updates/90_i386.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0498.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/9125"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/1948"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=124968"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10848"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.