Read the docs
TI-2011-01488 Aliases CVE-2011-1709GHSA-m8qj-xwm5-fq5v

GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a…

Priority LOW 32CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges via vectors involving the x-scheme-handler/http MIME type.

Why it matters now

EPSS 0.00432 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:gnome:gdm:1.0:*:*:*:*:*:*:*1.0VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:*2.0VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:*2.2VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:*2.3VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:*2.4VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:*2.5VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:*2.6VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:*2.8VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:*2.13VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:*2.14VulnerableGNOME
  • cpe:2.3:a:gnome:gdm:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:* Versions 2.13 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·GNOME
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnome:gdm:2.15:*:*:*:*:*:*:*2.15VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.16:*:*:*:*:*:*:*2.16VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.17:*:*:*:*:*:*:*2.17VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.18:*:*:*:*:*:*:*2.18VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.19:*:*:*:*:*:*:*2.19VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.20:*:*:*:*:*:*:*2.20VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.21:*:*:*:*:*:*:*2.21VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.22:*:*:*:*:*:*:*2.22VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.23:*:*:*:*:*:*:*2.23VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.24:*:*:*:*:*:*:*2.24VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.25:*:*:*:*:*:*:*2.25VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.26:*:*:*:*:*:*:*2.26VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.27:*:*:*:*:*:*:*2.27VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.28:*:*:*:*:*:*:*2.28VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.29:*:*:*:*:*:*:*2.29VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.30:*:*:*:*:*:*:*2.30VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.31:*:*:*:*:*:*:*2.31VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.32:*:*:*:*:*:*:*2.32VulnerableGNOME
cpe:2.3:a:gnome:gdm:2.32.1:*:*:*:*:*:*:*2.32.1VulnerableGNOME
cpe:2.3:a:gnome:glib:2.28:*:*:*:*:*:*:*2.28Running onGNOME
  • cpe:2.3:a:gnome:gdm:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.16:*:*:*:*:*:*:* Versions 2.16 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.17:*:*:*:*:*:*:* Versions 2.17 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.18:*:*:*:*:*:*:* Versions 2.18 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.27:*:*:*:*:*:*:* Versions 2.27 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.28:*:*:*:*:*:*:* Versions 2.28 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.29:*:*:*:*:*:*:* Versions 2.29 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.30:*:*:*:*:*:*:* Versions 2.30 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.31:*:*:*:*:*:*:* Versions 2.31 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.32:*:*:*:*:*:*:* Versions 2.32 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:gdm:2.32.1:*:*:*:*:*:*:* Versions 2.32.1 Vulnerable ·GNOME
  • cpe:2.3:a:gnome:glib:2.28:*:*:*:*:*:*:* Versions 2.28 Running on ·GNOME

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-1709
  2. 2026-10-03 Alias added: GHSA-m8qj-xwm5-fq5v

References

Patch 2

Advisory 3

Other 1

  • TI-2000-00491 Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote… CVSS 2.0HIGH 10.0
  • TI-2009-02579 The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat… CVSS 2.0MEDIUM 6.8
  • TI-2011-00635 GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership… CVSS 2.0MEDIUM 6.9
  • TI-2000-00503 libICE in XFree86 allows remote attackers to cause a denial of service by specifying a… CVSS 2.0MEDIUM 5.0
  • TI-2003-00517 The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows… CVSS 2.0MEDIUM 5.0
  • TI-2003-00516 The X Display Manager Control Protocol (XDMCP) support for GDM before 2.4.1.6 allows… CVSS 2.0MEDIUM 5.0
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences