Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xscreensaver | Xscreensaver | 4.05_5cl (including) | 4.05_5cl (including) |
| Xscreensaver | Xscreensaver | 4.05_6 (including) | 4.05_6 (including) |
| Xscreensaver | Xscreensaver | 4.05_6a (including) | 4.05_6a (including) |
| Xscreensaver | Xscreensaver | 4.05_150 (including) | 4.05_150 (including) |
| Xscreensaver | Xscreensaver | 4.07_2 (including) | 4.07_2 (including) |
| Xscreensaver | Xscreensaver | 4.08_29135cl (including) | 4.08_29135cl (including) |
| Xscreensaver | Xscreensaver | 4.09_0 (including) | 4.09_0 (including) |
| Xscreensaver | Xscreensaver | 4.10_4 (including) | 4.10_4 (including) |
| Xscreensaver | Xscreensaver | 4.10_6 (including) | 4.10_6 (including) |
| Xscreensaver | Xscreensaver | 4.10_8 (including) | 4.10_8 (including) |
| Xscreensaver | Xscreensaver | 4.10_15 (including) | 4.10_15 (including) |
| Xscreensaver | Xscreensaver | 4.11_0 (including) | 4.11_0 (including) |
| Xscreensaver | Xscreensaver | 4.12_58 (including) | 4.12_58 (including) |
| Xscreensaver | Xscreensaver | 4.12_62 (including) | 4.12_62 (including) |
| Xscreensaver | Xscreensaver | 4.14_0 (including) | 4.14_0 (including) |
| Xscreensaver | Xscreensaver | 4.14_2 (including) | 4.14_2 (including) |
| Xscreensaver | Xscreensaver | 4.14_4 (including) | 4.14_4 (including) |
| Xscreensaver | Xscreensaver | 4.14_5 (including) | 4.14_5 (including) |
| Red Hat Enterprise Linux 3 | RedHat | xscreensaver-1:4.10-20 | * |