Description of problem: gdm used to be built with tcpwrappers on previous RHEL releases, although the BuildRequires was missing there as well. The tcpwrappers package just happened to appear in the buildroot.

I believe it's nice to be able to limit XDMCP connections using hosts.{allow,deny}.

Version-Release number of selected component (if applicable): gdm-2.16.0-30.el5

Additional info: If you're going to fix this, don't forget that bug 181302 applies here as well.

GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges via vectors involving the x-scheme-handler/http MIME type.

GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.