Description
X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into an account whose password field contains invalid characters, as demonstrated using the crypt function from glibc 2.17 and later with (1) the "!" character in the salt portion of a password field or (2) a password that has been encrypted using DES or MD5 in FIPS-140 mode.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xdm | 1.1.12-16.3 | openSUSE-SU-2024:11519-1 |
Advisories 1
- openSUSE-SU-2024:11519-1 xdm-1.1.12-16.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2013:1117 vendor-advisory
- [oss-security] 20130613 Re: CVE request for possible NULL ptr deref in XDM when using crypt() from glibc 2.17+ mailing-list
- https://bugs.mageia.org/show_bug.cgi?id=10682
- http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117