CVE-2020-28049: Debian Linux

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and, for example, intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Sddm Project Sddm: before 0.19.0 (fixed in 0.19.0)

Published 2020-11-04. Last modified 2026-06-17.