Gnome: Security Vulnerabilities
Format string vulnerability in the permitted function of GNOME libgtop_daemon in libgtop 1.0.12 and earlier allows remote attackers to execute arbitrary code via an argument that contains format specifiers that are passed into the (1) syslog_message and (2) syslog_io_message functions.
CVSS Score
7.5
EPSS Score
0.028
Published
2001-11-27
GTK+ library allows local users to specify arbitrary modules via the GTK_MODULES environmental variable, which could allow local users to gain privileges if GTK+ is used by a setuid/setgid program.
CVSS Score
7.2
EPSS Score
0.012
Published
2001-02-12
GnoRPM before 0.95 allows local users to modify arbitrary files via a symlink attack.
CVSS Score
7.2
EPSS Score
0.004
Published
2000-12-19
Race condition in the creation of a Unix domain socket in GNOME esound 0.2.19 and earlier allows a local user to change the permissions of arbitrary files and directories, and gain additional privileges, via a symlink attack.
CVSS Score
6.2
EPSS Score
0.007
Published
2000-11-14
libICE in XFree86 allows remote attackers to cause a denial of service by specifying a large value which is not properly checked by the SKIP_STRING macro.
CVSS Score
5.0
EPSS Score
0.033
Published
2000-06-19
Buffer overflow in the XDMCP parsing code of GNOME gdm, KDE kdm, and wdm allows remote attackers to execute arbitrary commands or cause a denial of service via a long FORWARD_QUERY request.
CVSS Score
10.0
EPSS Score
0.178
Published
2000-05-24
Error messages generated by gdm with the VerboseAuth setting allows an attacker to identify valid users on a system.
CVSS Score
2.1
EPSS Score
0.004
Published
1999-12-05
Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument in programs such as nethack.
CVSS Score
7.2
EPSS Score
0.011
Published
1999-09-23
Page 36