Overview
- Description
- Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog.
- Source
- secalert@redhat.com
- NVD status
- Modified
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 4.3
- Impact score
- 6.4
- Exploitability score
- 3.1
- Vector string
- AV:L/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- NVD-CWE-Other
Social media
- Hype score
- Not currently trending
Vendor comments
- Red HatNot vulnerable. This flaw was first introduced in gdm version 2.14. Therefore these issues did not affect the earlier versions of gdm as shipped with Red Hat Enterprise Linux 2.1, 3, or 4. Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gnome:gdm:2.14.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B84ACF2-E06C-47E5-B221-78285238BA78"
},
{
"criteria": "cpe:2.3:a:gnome:gdm:2.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "832DE81E-18BB-4276-A6B0-F316A322E83E"
},
{
"criteria": "cpe:2.3:a:gnome:gdm:2.16.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D01F3328-9DB5-4C75-A9BD-96243975A362"
},
{
"criteria": "cpe:2.3:a:gnome:gdm:2.16.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24D361EF-B35F-46D9-9DF3-9254FFAD0A1F"
}
],
"operator": "OR"
}
]
}
]