Package: xscreensaver Version: 6.09+dfsg1-2 Followup-For: Bug #816722 X-Debbugs-Cc: [email protected]
This issue should be marked with top severity. As it stands, it seems to me to be a security issue — any package anyone installs that happens to be named the same as an enabled screensaver will be auto-run randomly by `xscreensaver`, as far as I can tell. The paths in `xscreensaver`, `xscreensaver-data` and `screensaver-data-extras` should be fully qualified. I'm sorely tempted to post an exploit… Please fix. I'm happy to contribute patches if that's what it takes. But hey, at least Zoom has quit popping up randomly on my desktop since I qualified my paths. -- System Information: Debian Release: trixie/stable APT prefers stable-updates APT policy: (990, 'stable-updates'), (990, 'stable-security'), (950, 'stable'), (450, 'testing'), (440, 'unstable'), (201, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 6.12.113+deb13-amd64 (SMP w/32 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages xscreensaver depends on: ii init-system-helpers 1.69+nmu3 ii libatk1.0-0t64 2.62.1-1 ii libc6 2.43-7 ii libcrypt1 1:4.4.38-1 ii libegl1 1.7.0-3+b1 ii libglib2.0-0t64 2.90.1-2 ii libgtk-3-0t64 3.24.52-3 ii libpam0g 1.7.0-8 ii libsystemd0 262-1 ii libx11-6 2:1.8.14-1 ii libxext6 2:1.3.4-1+b3 ii libxft2 2.3.6-1+b5 ii libxi6 2:1.8.4-1 ii libxinerama1 2:1.1.4-3+b5 ii libxml2-16 2.15.4+dfsg-1+b1 ii libxrandr2 2:1.5.4-1+b4 ii libxt6t64 1:1.2.1-1.3+b2 ii libxxf86vm1 1:1.1.4-2+b1 ii xscreensaver-data 6.09+dfsg1-2 Versions of packages xscreensaver recommends: ii fonts-urw-base35 20200910-9 ii libjpeg-turbo-progs 1:3.1.3-4 ii perl 5.42.3-1 ii wamerican [wordlist] 2020.12.07-4 ii xfonts-100dpi 1:1.0.5 ii xscreensaver-gl 6.09+dfsg1-2 Versions of packages xscreensaver suggests: ii firefox [www-browser] 159.0-1 ii firefox-esr [www-browser] 153.6.0esr-1~deb13u1 pn fortune <none> pn gdm3 <none> ii google-chrome-stable [www-browser] 157.0.8103.38-1 ii hv3 [www-browser] 3.0~fossil20110109-9 ii lynx [www-browser] 2.9.3-2 pn streamer <none> pn xdaliclock <none> pn xfishtank <none> ii xscreensaver-data-extra 6.09+dfsg1-1 ii xscreensaver-gl-extra 6.09+dfsg1-2 -- no debconf information
