A weakness has been reported in GTK+, which can be exploited by malicious people with physical access to bypass certain security restrictions.

The weakness is caused due to the "gdk_window_begin_implicit_paint()" function in gdk/gdkwindow.c potentially trying to paint on non-existent foreign windows. This can lead to e.g. a crash in gnome-screensaver, which can be exploited to bypass the screen lock.

The weakness is reported in version 2.18.4. Other versions may also be affected.

Solution
Update to version 2.18.5.

Provided and/or discovered by
Crashes reported by e.g. Richard Ssekibuule and various others.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://ftp.gnome.org/pub/gnome/sources/gtk+/2.18/gtk+-2.18.5.news

https://bugzilla.gnome.org/show_bug.cgi?id=598476
https://bugs.edge.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/446395
https://bugzilla.redhat.com/show_bug.cgi?id=540308

Deep Links
Links available to Secunia VIM customers