CVE-2017-11171

Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible.

• CWE-835

• https://bugzilla.suse.com/show_bug.cgi?id=1025068Issue Tracking, Third Party Advisory
• https://github.com/GNOME/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9dThird Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1025068Issue Tracking, Third Party Advisory
• https://github.com/GNOME/gnome-session/commit/b0dc999e0b45355314616321dbb6cb71e729fc9dThird Party Advisory

Published

Jul 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11165dataTaker DT80 dEX 1.50.012 allows remote attackers to obtai…9.8
• CVE-2017-11166The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0…
• CVE-2017-11167FineCMS 2.1.0 allows remote attackers to execute arbitrary P…
• CVE-2017-11169Privilege Escalation on iBall iB-WRA300N3GT iB-WRA300N3GT_1.…
• CVE-2017-1117IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated us…
• CVE-2017-11170The ReadTGAImage function in coders\tga.c in ImageMagick 7.0…
• CVE-2017-11173Missing anchor in generated regex for rack-cors before 0.4.1…8.8
• CVE-2017-11174In install/page_dbsettings.php in the Core distribution of X…
• CVE-2017-11175In J2 Innovations FIN Stack 4.0, the authentication webform …6.1
• CVE-2017-11176The mq_notify function in the Linux kernel through 4.11.9 do…7.8
• CVE-2017-11177TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict…
• CVE-2017-11178In FineCMS through 2017-07-11, application/core/controller/s…