CVE-2009-1276

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail notifications.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securitytracker.com/id?1022009
http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-22-1Patch, Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-255308-1Patch, Vendor Advisory
http://www.securityfocus.com/bid/34421
http://www.vupen.com/english/advisories/2009/0978
http://securitytracker.com/id?1022009
http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-22-1Patch, Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-255308-1Patch, Vendor Advisory
http://www.securityfocus.com/bid/34421
http://www.vupen.com/english/advisories/2009/0978

Timeline

Published: Apr 9, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-12777.5SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the CVE-2009-12787.5Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to inject arbitrar CVE-2009-12792.6Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HT CVE-2009-12806.8Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers CVE-2009-12814.3Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspeci CVE-2009-12827.5SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL CVE-2009-12836.8glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gai CVE-2009-12845.0Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib CVE-2009-12857.5Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows CVE-2009-12865.0The IMAP task in the server in IBM Lotus Domino 8.0.2 before FP1 IF1 and 8.5 before IF3 allows remote attackers to cause a denial of service CVE-2009-12874.3Cross-site scripting (XSS) vulnerability in Cisco Subscriber Edge Services Manager (SESM) allows remote attackers to inject arbitrary web sc CVE-2009-12884.3Multiple cross-site scripting (XSS) vulnerabilities in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCente