Unscored severity · published Aug 7, 2007
CVE-2007-3381
The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from…
–
CVSS
0.3%
EPSS
No
On KEV
Description
The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
Gdm · Gnome
through 2.14.12; 0.7; 1.0; 2.0; 2.2; 2.3; +33 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3381
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3381
ftp.gnome.org
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.14/gdm-2.14.13.news
ftp.gnome.org
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.16/gdm-2.16.7.changes
ftp.gnome.org
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.18/gdm-2.18.4.news
ftp.gnome.org
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.19/gdm-2.19.5.news
Vendor Advisory
http://secunia.com/advisories/26313
Vendor Advisory
http://secunia.com/advisories/26368
More from Gdm
–
CVE-2011-1709
GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges…
–
CVE-2011-0727
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under…
–
CVE-2009-2697
The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to…
–
CVE-2006-6105
Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string…
–
CVE-2006-2452
GNOME GDM 2.8, 2.12, 2.14, and 2.15, when the "face browser" feature is enabled, allows local users to access the "Configure Login Manager" functionality using their own password…