CVE-2013-4509
No CVSS score yet. EPSS 0.3% chance of exploitation in the next 30 days.
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-255
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ibus_project:ibus
- opensuse:opensuse
References
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00036.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00024.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00045.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1027028
- https://code.google.com/p/mozc/issues/attachmentText?id=199&aid=1990002000&name=ibus-mozc_support_ibus-1.5.4_rev2.diff&token=P62umpXGXx68XJT6zyvBA727wqE%3A1383693105690