CVE-2007-3381: Input Validation
The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the gstrsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3381?
CVE-2007-3381 is classified as a denial of service vulnerability that can result in a persistent daemon crash.
How do I fix CVE-2007-3381?
To mitigate CVE-2007-3381, upgrade the GNOME Display Manager to version 2.14.13, 2.16.7, 2.18.4, or 2.19.5 or later.
What systems are affected by CVE-2007-3381?
CVE-2007-3381 affects multiple versions of the GNOME Display Manager, specifically versions prior to 2.14.13, 2.16.7, 2.18.4, and 2.19.5.
Can CVE-2007-3381 be exploited remotely?
No, CVE-2007-3381 requires local access to exploit as it affects local users of the GNOME Display Manager.
What is the impact of CVE-2007-3381 on users?
Users may experience service interruptions due to the crashing of the GDM daemon when this vulnerability is exploited.