CVE-2013-4143: The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handl...

Security readout for executives and security teams

CVE-2013-4143 is a screen-lock bypass in xlockmore before 5.43. When certain password-checking functions mishandle NULL returns from crypt-related functions in glibc 2.17 and later, an attacker may bypass the locked session. The main business risk is unauthorized access to an already logged-in workstation. Exposure is likely limited to systems running xlockmore before 5.43, especially on platforms using glibc 2.17 or later. This is most relevant for Linux workstations, shared terminals, kiosks, or lab machines where xlockmore protects active sessions. Treat this as a workstation access-control issue, not a broad remote compromise. Patch or replace affected screen-lock deployments where physical or shared access matters, especially on administrator and shared systems. Mitigation focus: Upgrade xlockmore to 5.43 or a vendor-patched package.; Check distribution advisories for backported fixes before relying on version strings.; Avoid using vulnerable xlockmore builds to protect shared or unattended workstations..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.