This update for gdm provides the following fixes :

This security issue was fixed :

CVE-2018-14424: The daemon in GDM did not properly unexport display objects from its D-Bus interface when they are destroyed, which allowed a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution (bsc#1103737)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The daemon in GDM does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution.

For Debian 8 'Jessie', this problem has been fixed in version 3.14.1-7+deb8u1.

We recommend that you upgrade your gdm3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A use-after-free was discovered in GDM. A local user could exploit this to cause a denial of service, or potentially execute arbitrary code as the administrator.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gdm provides the following fixes :

This security issue was fixed :

  - CVE-2018-14424: The daemon in GDM did not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allowed a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial of     service or potential code execution (bsc#1103737)

These non-security issues were fixed :

  - Enable pam_keyinit module (bsc#1081947)

  - Fix a build race in SLE (bsc#1103093)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gdm: use-after-free in the GDM daemon (CVE-2018-14424)

  - gdm: inability to timely contact accountservice via dbus leads gnome-initial-setup to creation of account     with admin privileges (CVE-2020-16125)

  - gdm3 3.14.2 and possibly later has an information leak before screen lock (CVE-2016-1000002)

  - A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session     shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing     their session without authentication. This is similar to CVE-2017-12164, but requires more difficult     conditions to exploit. (CVE-2020-27837)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for gdm fixes the following security issue :

  - CVE-2018-14424: The daemon in GDM did not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allowed a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial of     service or potential code execution (bsc#1103737).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in gdm before 3.31.4.
    When timed login is enabled in configuration, an     attacker could bypass the lock screen by selecting the     timed login user and waiting for the timer to expire,     at which time they would gain access to the logged-in     user's session.(CVE-2019-3825)

  - The daemon in GDM through 3.29.1 does not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allows a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial     of service or potential code execution.(CVE-2018-14424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Chris Coulson discovered a use-after-free flaw in the GNOME Display Manager, triggerable by an unprivileged user via a specially crafted sequence of D-Bus method calls, leading to denial of service or potentially the execution of arbitrary code.

gdm 3.28.3 release, fixing CVE-2018-14424.

  - CVE-2018-14424 - double free fix

  - lifecycle fixes to libgdm/GdmClient

  - follow up fixes dealing with login screen reaping form     last release

  - allow pam modules to use SIGUSR1

  - set PWD for user session

  - tell cirrus not to use wayland

  - Translation updates

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gdm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The daemon in GDM through 3.29.1 does not properly     unexport display objects from its D-Bus interface when     they are destroyed, which allows a local attacker to     trigger a use-after-free via a specially crafted     sequence of D-Bus method calls, resulting in a denial     of service or potential code execution.(CVE-2018-14424)

  - A vulnerability was discovered in gdm before 3.31.4.
    When timed login is enabled in configuration, an     attacker could bypass the lock screen by selecting the     timed login user and waiting for the timer to expire,     at which time they would gain access to the logged-in     user's session.(CVE-2019-3825)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
120102	SUSE SLED15 / SLES15 Security Update : gdm (SUSE-SU-2018:2771-1)	Nessus	SuSE Local Security Checks	1/2/2019	3/18/2020	high
117295	Debian DLA-1494-1 : gdm3 security update	Nessus	Debian Local Security Checks	9/6/2018	1/11/2021	high
111673	Ubuntu 18.04 LTS : GDM vulnerability (USN-3737-1)	Nessus	Ubuntu Local Security Checks	8/14/2018	10/20/2023	high
123308	openSUSE Security Update : gdm (openSUSE-2019-708)	Nessus	SuSE Local Security Checks	3/27/2019	1/19/2021	high
195369	RHEL 7 : gdm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
112146	SUSE SLED12 / SLES12 Security Update : gdm (SUSE-SU-2018:2527-1)	Nessus	SuSE Local Security Checks	8/28/2018	9/10/2019	high
146754	EulerOS 2.0 SP2 : gdm (EulerOS-SA-2021-1297)	Nessus	Huawei Local Security Checks	2/22/2021	1/19/2024	high
111668	Debian DSA-4270-1 : gdm3 - security update	Nessus	Debian Local Security Checks	8/14/2018	11/13/2018	high
120483	Fedora 28 : 1:gdm (2018-6740c38cf4)	Nessus	Fedora Local Security Checks	1/3/2019	1/6/2021	high
149178	EulerOS 2.0 SP3 : gdm (EulerOS-SA-2021-1787)	Nessus	Huawei Local Security Checks	4/30/2021	1/2/2024	high
117685	openSUSE Security Update : gdm (openSUSE-2018-1037)	Nessus	SuSE Local Security Checks	9/25/2018	1/19/2021	high
144224	EulerOS 2.0 SP5 : gdm (EulerOS-SA-2020-2546)	Nessus	Huawei Local Security Checks	12/15/2020	2/1/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high