Description
The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gdm | 1:2.16.0-31.0.1.el5 | RHSA-2007:0777 |
Advisories 1
- RHSA-2007:0777 Red Hat Security Advisory: gdm security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- GLSA-200709-11 vendor-advisory
- http://ftp.gnome.org/pub/GNOME/sources/gdm/2.16/gdm-2.16.7.changes
- 26313 third-party-advisory
- ADV-2007-2781 vdb-entry
- 25191 vdb-entry
- 26879 third-party-advisory
- oval:org.mitre.oval:def:10887 vdb-entry signature
- https://issues.rpath.com/browse/RPL-1599
- http://ftp.gnome.org/pub/GNOME/sources/gdm/2.14/gdm-2.14.13.news
- 26368 third-party-advisory
- MDKSA-2007:169 vendor-advisory
- http://ftp.gnome.org/pub/GNOME/sources/gdm/2.18/gdm-2.18.4.news
- 20070803 FLEA-2007-0041-1 gdm mailing-list
- http://ftp.gnome.org/pub/GNOME/sources/gdm/2.19/gdm-2.19.5.news
- RHSA-2007:0777 vendor-advisory
- 1018523 vdb-entry
- 26900 third-party-advisory
- 26520 third-party-advisory