GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges via vectors involving the x-scheme-handler/http MIME type.

GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.

Description of problem: gdm used to be built with tcpwrappers on previous RHEL releases, although the BuildRequires was missing there as well. The tcpwrappers package just happened to appear in the buildroot.

I believe it's nice to be able to limit XDMCP connections using hosts.{allow,deny}.

Version-Release number of selected component (if applicable): gdm-2.16.0-30.el5

Additional info: If you're going to fix this, don't forget that bug 181302 applies here as well.

It was reported [1],[2] that when the fallback greeter is used in GDM3.x, if the disable-user-list setting is "true" (so a user list is not displayed, but entry fields for username and password), if a user enters their username and are then presented with a password prompt, if they were to click the "cancel" button then all of the user-interactive fields disappear. The user is then unable to login in or otherwise interact with the display manager, and must either kill X or reboot.

There is no upstream fix as of yet. CVE-2013-7273 was assigned [3] to this issue.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683338 [2] https://bugzilla.gnome.org/showbug.cgi?id=704284 [3] http://seclists.org/oss-sec/2014/q1/40

Gnome GDM 3.14.2 and possibly later are vulnerable to an information disclosure vulnerability, specifically when a laptop screen is closed to trigger the screen lock, and the lid is then re-opened the previous contents of the screen are visible for approx. 1 second, which is long enough to take a picture or video record it before the lock screen kicks in.