Unscored severity · published Dec 21, 2012
CVE-2010-2387
vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded…
–
CVSS
0.5%
EPSS
No
On KEV
Description
vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
Gnome Display Manager · Gnome
2.20.0; 2.20.1; 2.20.2; 2.20.3; 2.20.4; 2.20.5; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2387
ftp.gnome.org
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes
Vendor Advisory
http://secunia.com/advisories/40690
Vendor Advisory
http://secunia.com/advisories/40780
US Government Resource
http://www.auscert.org.au/13123
www.osvdb.org
http://www.osvdb.org/66643
blogs.oracle.com
https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure
More from Gnome Display Manager
7.8
CVE-2018-14424
The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a…
6.8
CVE-2020-16125
gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially…
6.4
CVE-2020-27837
A flaw was found in GDM in versions prior to 3.38.2.1
6.4
CVE-2019-3825
A vulnerability was discovered in gdm before 3.31.4
6.4
CVE-2017-12164
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin