CVE-2007-3381

The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from the g_strsplit function, which allows local users to cause a denial of service (persistent daemon crash) via a crafted command to the daemon's socket, related to (1) gdm.c and (2) gdmconfig.c in daemon/, and (3) gdmconfig.c and (4) gdmflexiserver.c in gui/.

Published: 2007-08-07 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2007-3381 is rated Low Risk (16.1/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.06%). Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2007-3381

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2024-10-02 0.04% 0.06% +0.02%
2 2023-03-07 1.55% 0.04% -1.50%
3 2022-02-04 — 1.55% —

Full EPSS history (3 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2007-3381

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
1.5 2.0 LOW
AV:L/AC:M/Au:S/C:N/I:N/A:P Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:S)
A single authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
 2.7 2.9 [email protected]

Weakness enumeration for CVE-2007-3381

OS Trackers for CVE-2007-3381

vendor priority summary link
gentoo low CVE-2007-3381: 1 GLSA(s) (200709-11), 1 atom(s) (gnome-base/gdm); latest impact low. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2007-3381
redhat medium — https://access.redhat.com/security/cve/CVE-2007-3381
ubuntu negligible CVE-2007-3381 negligible priority: Ubuntu including 1 source packages (gdm), 8 status rows across 8 suites (dapper, edgy, feisty, gutsy, hardy, intrepid, jaunty, upstream): released 4, ignored 3, needs-triage 1. https://ubuntu.com/security/CVE-2007-3381

Affected software / configurations for CVE-2007-3381

Vendor Product Version Raw CPE
gnome gdm <= 2.14.12 cpe:2.3:a:gnome:gdm:*:*:*:*:*:*:*:*
gnome gdm 0.7 cpe:2.3:a:gnome:gdm:0.7:*:*:*:*:*:*:*
gnome gdm 1.0 cpe:2.3:a:gnome:gdm:1.0:*:*:*:*:*:*:*
gnome gdm 2.0 cpe:2.3:a:gnome:gdm:2.0:*:*:*:*:*:*:*
gnome gdm 2.2 cpe:2.3:a:gnome:gdm:2.2:*:*:*:*:*:*:*
gnome gdm 2.3 cpe:2.3:a:gnome:gdm:2.3:*:*:*:*:*:*:*
gnome gdm 2.4 cpe:2.3:a:gnome:gdm:2.4:*:*:*:*:*:*:*
gnome gdm 2.5 cpe:2.3:a:gnome:gdm:2.5:*:*:*:*:*:*:*
gnome gdm 2.6 cpe:2.3:a:gnome:gdm:2.6:*:*:*:*:*:*:*
gnome gdm 2.8 cpe:2.3:a:gnome:gdm:2.8:*:*:*:*:*:*:*
gnome gdm 2.13 cpe:2.3:a:gnome:gdm:2.13:*:*:*:*:*:*:*
gnome gdm 2.14 cpe:2.3:a:gnome:gdm:2.14:*:*:*:*:*:*:*
gnome gdm 2.14.1 cpe:2.3:a:gnome:gdm:2.14.1:*:*:*:*:*:*:*
gnome gdm 2.14.2 cpe:2.3:a:gnome:gdm:2.14.2:*:*:*:*:*:*:*
gnome gdm 2.14.3 cpe:2.3:a:gnome:gdm:2.14.3:*:*:*:*:*:*:*
gnome gdm 2.14.4 cpe:2.3:a:gnome:gdm:2.14.4:*:*:*:*:*:*:*
gnome gdm 2.14.5 cpe:2.3:a:gnome:gdm:2.14.5:*:*:*:*:*:*:*
gnome gdm 2.14.6 cpe:2.3:a:gnome:gdm:2.14.6:*:*:*:*:*:*:*
gnome gdm 2.14.7 cpe:2.3:a:gnome:gdm:2.14.7:*:*:*:*:*:*:*
gnome gdm 2.14.8 cpe:2.3:a:gnome:gdm:2.14.8:*:*:*:*:*:*:*
gnome gdm 2.14.9 cpe:2.3:a:gnome:gdm:2.14.9:*:*:*:*:*:*:*
gnome gdm 2.14.10 cpe:2.3:a:gnome:gdm:2.14.10:*:*:*:*:*:*:*
gnome gdm 2.14.11 cpe:2.3:a:gnome:gdm:2.14.11:*:*:*:*:*:*:*
gnome gdm 2.16 cpe:2.3:a:gnome:gdm:2.16:*:*:*:*:*:*:*
gnome gdm 2.16.1 cpe:2.3:a:gnome:gdm:2.16.1:*:*:*:*:*:*:*
gnome gdm 2.16.2 cpe:2.3:a:gnome:gdm:2.16.2:*:*:*:*:*:*:*
gnome gdm 2.18 cpe:2.3:a:gnome:gdm:2.18:*:*:*:*:*:*:*
gnome gdm 2.18.1 cpe:2.3:a:gnome:gdm:2.18.1:*:*:*:*:*:*:*
gnome gdm 2.18.2 cpe:2.3:a:gnome:gdm:2.18.2:*:*:*:*:*:*:*
gnome gdm 2.18.3 cpe:2.3:a:gnome:gdm:2.18.3:*:*:*:*:*:*:*
gnome gdm 2.19 cpe:2.3:a:gnome:gdm:2.19:*:*:*:*:*:*:*
gnome gdm 2.19.1 cpe:2.3:a:gnome:gdm:2.19.1:*:*:*:*:*:*:*
gnome gdm 2.19.2 cpe:2.3:a:gnome:gdm:2.19.2:*:*:*:*:*:*:*
gnome gdm 2.19.3 cpe:2.3:a:gnome:gdm:2.19.3:*:*:*:*:*:*:*
gnome gdm 2.19.4 cpe:2.3:a:gnome:gdm:2.19.4:*:*:*:*:*:*:*

References for CVE-2007-3381

URL Tags
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.14/gdm-2.14.13.news
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.16/gdm-2.16.7.changes
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.18/gdm-2.18.4.news
http://ftp.gnome.org/pub/GNOME/sources/gdm/2.19/gdm-2.19.5.news
http://secunia.com/advisories/26313 Vendor Advisory
http://secunia.com/advisories/26368 Vendor Advisory
http://secunia.com/advisories/26520 Vendor Advisory
http://secunia.com/advisories/26879 Vendor Advisory
http://secunia.com/advisories/26900 Vendor Advisory
http://security.gentoo.org/glsa/glsa-200709-11.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:169
http://www.redhat.com/support/errata/RHSA-2007-0777.html
http://www.securityfocus.com/archive/1/475451/30/5550/threaded
http://www.securityfocus.com/bid/25191
http://www.securitytracker.com/id?1018523
http://www.vupen.com/english/advisories/2007/2781 Vendor Advisory
https://issues.rpath.com/browse/RPL-1599
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10887
cvelogic Threat Intelligence