{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-02-15T00:00:00", "descriptions": [{"lang": "en", "value": "vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=571846"}, {"name": "ASB-2010.0184", "tags": ["third-party-advisory", "x_refsource_AUSCERT"], "url": "http://www.auscert.org.au/13123"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure"}, {"name": "40690", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/40690"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes"}, {"name": "solaris-gdm-information-disclosure(60642)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60642"}, {"name": "40780", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/40780"}, {"name": "66643", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/66643"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2010-2387", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.gnome.org/show_bug.cgi?id=571846", "refsource": "CONFIRM", "url": "https://bugzilla.gnome.org/show_bug.cgi?id=571846"}, {"name": "ASB-2010.0184", "refsource": "AUSCERT", "url": "http://www.auscert.org.au/13123"}, {"name": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure", "refsource": "CONFIRM", "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure"}, {"name": "40690", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/40690"}, {"name": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes", "refsource": "CONFIRM", "url": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes"}, {"name": "solaris-gdm-information-disclosure(60642)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60642"}, {"name": "40780", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/40780"}, {"name": "66643", "refsource": "OSVDB", "url": "http://www.osvdb.org/66643"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T02:32:16.591Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=571846"}, {"name": "ASB-2010.0184", "tags": ["third-party-advisory", "x_refsource_AUSCERT", "x_transferred"], "url": "http://www.auscert.org.au/13123"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure"}, {"name": "40690", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/40690"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes"}, {"name": "solaris-gdm-information-disclosure(60642)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60642"}, {"name": "40780", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/40780"}, {"name": "66643", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/66643"}]}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2010-2387", "datePublished": "2012-12-21T02:00:00", "dateReserved": "2010-06-21T00:00:00", "dateUpdated": "2024-08-07T02:32:16.591Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.0:*:*:*:*:*:*:*", "matchCriteriaId": "C8C72BE3-BDD4-4A88-8E2A-7C8224B02F76", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.1:*:*:*:*:*:*:*", "matchCriteriaId": "706CCECA-D2FC-40E6-B587-B6E3DD62075D", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.2:*:*:*:*:*:*:*", "matchCriteriaId": "8DA2D465-D13D-4871-A15F-BD54C602867D", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.3:*:*:*:*:*:*:*", "matchCriteriaId": "D0C53894-4DA5-425F-9DEB-C0371B206FBC", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.4:*:*:*:*:*:*:*", "matchCriteriaId": "06EB6BB7-9C4E-4D6B-8ED1-3588E290ADEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.5:*:*:*:*:*:*:*", "matchCriteriaId": "409CA831-8DD2-4ED0-9E46-E6EACA01D818", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.6:*:*:*:*:*:*:*", "matchCriteriaId": "D80F8AA1-0DBA-4B4A-8003-0977632EB92D", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.7:*:*:*:*:*:*:*", "matchCriteriaId": "67E978B3-1614-4591-B58E-9BA781AE0BE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.8:*:*:*:*:*:*:*", "matchCriteriaId": "C5535C17-2D38-49EC-8D44-F99F0B2BEB5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.9:*:*:*:*:*:*:*", "matchCriteriaId": "FE4EA4E1-3B52-4DD1-930D-8E88A2494D22", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnome:gnome_display_manager:2.20.10:*:*:*:*:*:*:*", "matchCriteriaId": "943E0B71-8FC7-46FB-BA5D-E3A2FD78636F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs."}, {"lang": "es", "value": "vicious-extensions/ve-misc.c en GNOME Display Manager (GDM) v2.20.x antes de v2.20.11, cuando la depuraci\u00f3n GDM est\u00e1 habilitada, registra la contrase\u00f1a de usuario cuando contiene caracteres no v\u00e1lidos UTF8 codificados, lo que podr\u00eda permitir a usuarios locales obtener privilegios mediante la lectura de la informaci\u00f3n de los registros de syslog."}], "id": "CVE-2010-2387", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-12-21T05:46:13.853", "references": [{"source": "[email protected]", "url": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40690"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40780"}, {"source": "[email protected]", "tags": ["US Government Resource"], "url": "http://www.auscert.org.au/13123"}, {"source": "[email protected]", "url": "http://www.osvdb.org/66643"}, {"source": "[email protected]", "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure"}, {"source": "[email protected]", "url": "https://bugzilla.gnome.org/show_bug.cgi?id=571846"}, {"source": "[email protected]", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60642"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://ftp.gnome.org/pub/GNOME/sources/gdm/2.20/gdm-2.20.11.changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40690"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/40780"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.auscert.org.au/13123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/66643"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://blogs.oracle.com/sunsecurity/entry/cve_2010_2387_password_disclosure"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.gnome.org/show_bug.cgi?id=571846"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60642"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "gdm: logs user passwors that contain invalid UTF8-encoded characters, in debug mode", "id": "889384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=889384"}, "csaw": false, "cvss": {"cvss_base_score": "1.0", "cvss_scoring_vector": "AV:L/AC:H/Au:S/C:P/I:N/A:N", "status": "draft"}, "details": ["vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs."], "name": "CVE-2010-2387", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "gdm", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "gdm", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2009-02-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2010-2387\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-2387"], "statement": "This is not a vulnerability. Red Hat Enterprise Linux does not have /var/log/messages world-readable, nor is GDM run in debug mode; both are requirements for this to be considered a flaw."}