CVE-2010-2387: Low severity Gnome GNOME Display Manager vulnerability
vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gdmto a version that resolves this vulnerability.Fixed in 2.20.11
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2387?
CVE-2010-2387 is considered a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2010-2387?
To fix CVE-2010-2387, update to GNOME Display Manager version 2.20.11 or later.
What software is affected by CVE-2010-2387?
CVE-2010-2387 affects GNOME Display Manager versions 2.20.0 to 2.20.10.
What kind of information is exposed by CVE-2010-2387?
CVE-2010-2387 can log user passwords when they contain invalid UTF8 encoded characters.
Is CVE-2010-2387 exploitable remotely?
CVE-2010-2387 is not directly exploitable remotely as it requires local access to the system.