Bug#1150544: gtk+3.0: a11y: Browse key listener list safely

[Salvatore Bonaccorso]

Source: gtk+3.0
Version: 3.24.52-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: affects -1 + xfce4-screensaver
Control: found -1 3.24.49-3

Hi

It was reported in context of xfce4-screensaver, that there could be
lock screen bypass via crashing the screensaver daemon (with a rapid
keystoke trigger):

https://gitlab.xfce.org/apps/xfce4-screensaver/-/work_items/199

The root cause was identified in gtk+3.0, and tracked in the merge:
https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/10391 with
upstream fix
https://gitlab.gnome.org/GNOME/gtk/-/commit/e6372d2923d04bb2bdc88fa526ca57704ca2664a
.

Regards,
Salvatore