Read the docs
TI-2011-00635 Aliases CVE-2011-0727GHSA-vqj4-7669-fw9c

GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership…

Priority LOW 31CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.

Why it matters now

EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:*2.0VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:*2.2VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:*2.3VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:*2.4VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:*2.5VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:*2.6VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:*2.8VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:*2.13VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:*2.14VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.15:*:*:*:*:*:*:*2.15VulnerableGNOME
  • cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:* Versions 2.13 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·GNOME
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnome:gdm:2.16:*:*:*:*:*:*:*2.16VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.17:*:*:*:*:*:*:*2.17VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.18:*:*:*:*:*:*:*2.18VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.19:*:*:*:*:*:*:*2.19VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.20:*:*:*:*:*:*:*2.20VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.21:*:*:*:*:*:*:*2.21VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.22:*:*:*:*:*:*:*2.22VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.23:*:*:*:*:*:*:*2.23VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.24:*:*:*:*:*:*:*2.24VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.25:*:*:*:*:*:*:*2.25VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.26:*:*:*:*:*:*:*2.26VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.27:*:*:*:*:*:*:*2.27VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.28:*:*:*:*:*:*:*2.28VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.29:*:*:*:*:*:*:*2.29VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.30:*:*:*:*:*:*:*2.30VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.31:*:*:*:*:*:*:*2.31VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.32:*:*:*:*:*:*:*2.32VulnerableGNOME
  • cpe:2.3:a:gnome:gdm:2.16:*:*:*:*:*:*:* Versions 2.16 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.17:*:*:*:*:*:*:* Versions 2.17 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.18:*:*:*:*:*:*:* Versions 2.18 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.27:*:*:*:*:*:*:* Versions 2.27 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.28:*:*:*:*:*:*:* Versions 2.28 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.29:*:*:*:*:*:*:* Versions 2.29 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.30:*:*:*:*:*:*:* Versions 2.30 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.31:*:*:*:*:*:*:* Versions 2.31 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.32:*:*:*:*:*:*:* Versions 2.32 Vulnerable ·GNOME

Remediation

Red Hat 1 advisory

  • RHSA-2011:0395 Released 2011-03-28 · Red Hat rating Moderate
    gdm security update
    • Red Hat Enterprise Linux Desktop (v. 6) gdm-1:2.30.4-21.el6_0.1, gdm-libs-1:2.30.4-21.el6_0.1, gdm-plugin-fingerprint-1:2.30.4-21.el6_0.1 +2
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) gdm-1:2.30.4-21.el6_0.1, gdm-libs-1:2.30.4-21.el6_0.1, gdm-plugin-fingerprint-1:2.30.4-21.el6_0.1 +2
    • Red Hat Enterprise Linux Server (v. 6) gdm-1:2.30.4-21.el6_0.1, gdm-libs-1:2.30.4-21.el6_0.1, gdm-libs-1:2.30.4-21.el6_0.1.ppc +3
    • Red Hat Enterprise Linux Workstation (v. 6) gdm-1:2.30.4-21.el6_0.1, gdm-libs-1:2.30.4-21.el6_0.1, gdm-plugin-fingerprint-1:2.30.4-21.el6_0.1 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:0395
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0395
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0395
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0395
Not affected: 2 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0727
  2. 2026-10-03 Alias added: GHSA-vqj4-7669-fw9c

References

Patch 2

Advisory 9

Other 3

  • TI-2000-00491 Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote… CVSS 2.0HIGH 10.0
  • TI-2009-02579 The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat… CVSS 2.0MEDIUM 6.8
  • TI-2011-01488 GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a… CVSS 2.0HIGH 7.2
  • TI-2000-00503 libICE in XFree86 allows remote attackers to cause a denial of service by specifying a… CVSS 2.0MEDIUM 5.0
  • TI-2003-00517 The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows… CVSS 2.0MEDIUM 5.0
  • TI-2003-00516 The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows… CVSS 2.0MEDIUM 5.0
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences