CVE-2007-3381

The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.

• CWE-20

• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.14/gdm-2.14.13.news
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.16/gdm-2.16.7.changes
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.18/gdm-2.18.4.news
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.19/gdm-2.19.5.news
• http://secunia.com/advisories/26313Vendor Advisory
• http://secunia.com/advisories/26368Vendor Advisory
• http://secunia.com/advisories/26520Vendor Advisory
• http://secunia.com/advisories/26879Vendor Advisory
• http://secunia.com/advisories/26900Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200709-11.xml
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:169
• http://www.redhat.com/support/errata/RHSA-2007-0777.html
• http://www.securityfocus.com/archive/1/475451/30/5550/threaded
• http://www.securityfocus.com/bid/25191
• http://www.securitytracker.com/id?1018523
• http://www.vupen.com/english/advisories/2007/2781Vendor Advisory
• https://issues.rpath.com/browse/RPL-1599
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10887
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.14/gdm-2.14.13.news
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.16/gdm-2.16.7.changes
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.18/gdm-2.18.4.news
• http://ftp.gnome.org/pub/GNOME/sources/gdm/2.19/gdm-2.19.5.news
• http://secunia.com/advisories/26313Vendor Advisory
• http://secunia.com/advisories/26368Vendor Advisory
• http://secunia.com/advisories/26520Vendor Advisory
• http://secunia.com/advisories/26879Vendor Advisory
• http://secunia.com/advisories/26900Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200709-11.xml
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:169
• http://www.redhat.com/support/errata/RHSA-2007-0777.html
• http://www.securityfocus.com/archive/1/475451/30/5550/threaded
• http://www.securityfocus.com/bid/25191
• http://www.securitytracker.com/id?1018523
• http://www.vupen.com/english/advisories/2007/2781Vendor Advisory
• https://issues.rpath.com/browse/RPL-1599
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10887

Published

Aug 7, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-3375Stack-based buffer overflow in Lhaca File Archiver before 1.…
• CVE-2007-3376Buffer overflow in Apple Safari 3.0.2 on Windows XP SP2 allo…
• CVE-2007-3377Header.pm in Net::DNS before 0.60, a Perl module, (1) genera…
• CVE-2007-3378The (1) session_save_path, (2) ini_set, and (3) error_log fu…
• CVE-2007-3379Unspecified vulnerability in the kernel in Red Hat Enterpris…
• CVE-2007-3380The Distributed Lock Manager (DLM) in the cluster manager fo…
• CVE-2007-3382Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0…
• CVE-2007-3383Cross-site scripting (XSS) vulnerability in SendMailServlet …
• CVE-2007-3384Multiple cross-site scripting (XSS) vulnerabilities in examp…
• CVE-2007-3385Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0…
• CVE-2007-3386Cross-site scripting (XSS) vulnerability in the Host Manager…
• CVE-2007-3387Integer overflow in the StreamPredictor::StreamPredictor fun…