Description
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdm3 | 2.30.5-9 | — |
| Debian 13 | gdm3 | 2.30.5-9 | — |
| Debian 12 | gdm3 | 2.30.5-9 | — |
| Debian 6.0 | gdm3 | 2.30.5-6squeeze2 | DSA-2205-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | gdm +4 | 1:2.30.4-21.el6_0.1 | RHSA-2011:0395 |
Advisories 2
- RHSA-2011:0395 Red Hat Security Advisory: gdm security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2205-1 gdm3 - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-1099-1 vendor-advisory
- 43714 third-party-advisory
- 1025264 vdb-entry
- FEDORA-2011-4351 vendor-advisory
- 43854 third-party-advisory
- ADV-2011-0847 vdb-entry
- ADV-2011-0787 vdb-entry
- display-manager-priv-escalation(66377) vdb-entry
- ADV-2011-0911 vdb-entry
- MDVSA-2011:070 vendor-advisory
- DSA-2205 vendor-advisory
- RHSA-2011:0395 vendor-advisory
- 47063 vdb-entry
- ADV-2011-0786 vdb-entry
- [gdm-list] 20110328 GDM 2.32.1 released mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=688323
- http://ftp.gnome.org/pub/GNOME/sources/gdm/2.32/gdm-2.32.1.news
- 44021 third-party-advisory
- FEDORA-2011-4335 vendor-advisory
- ADV-2011-0797 vdb-entry