Dear Maintainer,

Below is a description of a security flaw in the 'distort' option of xscreensaver. In short, when changing from account 'A' to account 'B', a distort of account 'C' is displayed, thus compromising the privacy and security of account 'C'.

The environment is a multi-user system on a single physical termianl. Two user accounts are running X sessions; The third is not, and never has.

Switching between accounts is being done by keybindings. The first Xsession account was bound to Ctrl-Alt-F7, the second to Ctrl-Alt-F2, and the noX account to Ctrl-Alt-F1.

In the observed incident, a switch was made from tty7 (displaying windows of several processes) to tty2 (displaying windows of several different processes), yet the screenasver displayed the emacs session being run on the third account, running on tty1