CVE-2010-0732

CVE-2010-0732 is a medium-severity vulnerability in Gnome Gtk with a CVSS 2.0 base score of 6.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-362.

Key facts

• Severity: Medium (CVSS 2.0 base score 6.2)
• EPSS exploit prediction: 0% (22nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-362
• Affected product: Gnome Gtk
• Published: 2010-03-19
• Last modified: 2026-06-16

Description

gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.

Frequently asked questions

What is CVE-2010-0732?

gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.

How severe is CVE-2010-0732?

CVE-2010-0732 has a CVSS 2.0 base score of 6.2, rated medium severity.

Is CVE-2010-0732 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2010-0732?

CVE-2010-0732 primarily affects Gnome Gtk. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2010-0732?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2010-0732 published?

CVE-2010-0732 was published on 2010-03-19 and last updated on 2026-06-16.

References

• http://ftp.gnome.org/pub/gnome/sources/gtk+/2.18/gtk+-2.18.5.news
• http://git.gnome.org/browse/gnome-screensaver/commit/?h=gnome-2-28&id=98f8a22412cf388217fd5b88915eadd274d68520
• http://git.gnome.org/browse/gnome-screensaver/commit/?id=ab08cc93f2dc6223c8c00bfa1ca4f2d89069dbe0
• http://git.gnome.org/browse/gtk+/commit/?id=0748cf563d0d0d03001a62589f13be16a8ec06c1
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
• http://secunia.com/advisories/39317
• http://www.heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-2-Update-928580.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:109
• http://www.openwall.com/lists/oss-security/2010/02/12/1
• http://www.openwall.com/lists/oss-security/2010/03/05/2
• http://www.openwall.com/lists/oss-security/2010/03/16/9
• http://www.securityfocus.com/bid/38211
• https://bugs.edge.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/446395
• https://bugzilla.gnome.org/show_bug.cgi?id=598476
• https://bugzilla.redhat.com/show_bug.cgi?id=565527

Affected products (2)

• cpe:2.3:a:gnome:gtk:*:*:*:*:*:*:*:*
• cpe:2.3:a:gnome:screensaver:*:*:*:*:*:*:*:*

More vulnerabilities in Gnome Gtk

• CVE-2012-0828 — Critical (CVSS 9.8): Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote…
• CVE-2010-4833 — Critical (CVSS 9.3): Untrusted search path vulnerability in modules/engines/ms-windows/xp_theme.c in GTK+ before 2.24.0 allows local users…
• CVE-2005-2975 — High (CVSS 7.8): io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of…
• CVE-2005-2976 — High (CVSS 7.5): Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service…
• CVE-2005-0891 — High (CVSS 7.5): Double free vulnerability in gtk 2 (gtk2) before 2.2.4 allows remote attackers to cause a denial of service (crash) via…
• CVE-2004-0783 — High (CVSS 7.5): Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier,…

All CVEs affecting Gnome Gtk →

Other CWE-362 (Race Condition) vulnerabilities

• CVE-2022-27626 — Critical (CVSS 10.0): A vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition')…
• CVE-2015-8556 — Critical (CVSS 10.0): Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
• CVE-2014-0703 — Critical (CVSS 10.0): Cisco Wireless LAN Controller (WLC) devices 7.4 before 7.4.110.0 distribute Aironet IOS software with a race condition…
• CVE-2010-1228 — Critical (CVSS 10.0): Multiple race conditions in the sandbox infrastructure in Google Chrome before 4.1.249.1036 have unspecified impact and…
• CVE-2008-6598 — Critical (CVSS 10.0): Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."
• CVE-2026-46137 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential…

Browse all CWE-362 (Race Condition) vulnerabilities →