CVE-2009-2697: The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHE

Q: How do I fix CVE-2009-2697?

gdm: upgrade to newer than 2.16. Exact commands for each OS are on this page.

Q: Is CVE-2009-2697 being exploited?

CVE-2009-2697 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2009-2697 affect?

CVE-2009-2697 affects gdm. Severity is medium (CVSS 6.8). The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a

Q: How urgent is CVE-2009-2697?

Priority 49/100. On your watchlist

This month

MEDIUM 6.8WATCHLISTUPGRADE

CVE-2009-2697 is a medium-severity flaw (CVSS 6.8) affecting gdm. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.

Why this priority

On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	6.8 (Medium)
EPSS exploit chance	1.8% (top 21%)
CISA exploited list	No
Weakness	CWE-287
Published	2009-09-04
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: gnome

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2009-09-04 20:30 UTCPublished CVE record published
2026-06-16 23:10 UTCUpdated Record last modified

gnome gdm UPGRADE

Affected: <= 2.16 · 0.7 · 1.0 · 2.0 · 2.2 · 2.3 · 2.4 · 2.5

Fixed in: newer than 2.16

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy gdm || rpm -q gdm || gdm --version

2. UPGRADE to newer than 2.16 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade gdm

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade gdm

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2009-2697?

gdm: upgrade to newer than 2.16. Exact commands for each OS are on this page.

Is CVE-2009-2697 being exploited?

CVE-2009-2697 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2009-2697 affect?

CVE-2009-2697 affects gdm. Severity is medium (CVSS 6.8). The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a

How urgent is CVE-2009-2697?

Priority 49/100. On your watchlist

Software pages

Red Hat Enterprise Linux vulnerabilities

Related CVEs

CVE-2011-1709 HIGH 7.2 DOWNGRADE GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the
CVE-2011-0727 MEDIUM 6.9 DOWNGRADE GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files vi
CVE-2007-3381 LOW 1.5 UPGRADE The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and
CVE-2006-6105 MEDIUM 4.3 DOWNGRADE Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm)
CVE-2006-2452 LOW 3.7 DOWNGRADE GNOME GDM 2.8, 2.12, 2.14, and 2.15, when the "face browser" feature is enabled, allows local users to access

References

← Back to latest CVEs