backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade kdebase3 | Dec 10, 2025 | Sep 19, 2007 |
| Gentoo Linux | — | Upgrade kde-base/kdebase.Upgrade kde-base/kdm. | Oct 30, 2017 | Sep 21, 2007 |
| Oracle_linux | — | Upgrade kdebase-develUpgrade kdebase | Oct 16, 2024 | Sep 21, 2007 |
| Suse | — | Upgrade misc-console-fontUpgrade kdebase3-32bitUpgrade kdebase3-runtime-32bitUpgrade kdebase3-runtime-x86Upgrade kdebase3Upgrade filesharesetUpgrade kdebase3-develUpgrade kdebase3-runtime | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade kdm | Nov 8, 2024 | Sep 21, 2007 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub