CVE-2015-7496
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the...
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Exploit likelihood
What each source reports
NVD Score used
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
CVE-2015-7496- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
CVE-2015-7496- Updated
- 2026-11-02
EUVDEUVD-2015-7420 No score
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
EUVD-2015-7420- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qwh9-f2h4-mw38 No score
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the...
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
GHSA-qwh9-f2h4-mw38- Updated
- 2026-11-02
OSVRHSA-2017:2128
Red Hat Security Advisory: gdm and gnome-session security, bug fix, and enhancement update
- Record
RHSA-2017:2128- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSV No score
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
CVE-2015-7496- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2015-7496 No score
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
DEBIAN-CVE-2015-7496- Updated
- 2026-11-02
OSVMGASA-2017-0248 No score
Updated gdm packages fix security vulnerability
It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is locked, possibly bypassing the locked screen (CVE-2015-7496).
- Record
MGASA-2017-0248- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10412-1 No score
gdm-3.22.1-1.2 on GA media
These are all security issues fixed in the gdm-3.22.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10412-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7496 No score
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
- Record
UBUNTU-CVE-2015-7496- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gdm3Debian:12 |
before 3.18.2-1 | 3.18.2-1 |
gdm3Debian:13 |
before 3.18.2-1 | 3.18.2-1 |
gdm3Debian:14 |
before 3.18.2-1 | 3.18.2-1 |
gdmMageia:5 |
before 3.14.2-5.1.mga5 | 3.14.2-5.1.mga5 |
gdm-debuginfoRed Hat:enterprise_linux:7::client |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gdm-develRed Hat:enterprise_linux:7::client |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-session-custom-sessionRed Hat:enterprise_linux:7::client |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-debuginfoRed Hat:enterprise_linux:7::client |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdmRed Hat:enterprise_linux:7::client |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-sessionRed Hat:enterprise_linux:7::client |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnome-session-xsessionRed Hat:enterprise_linux:7::client |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdmRed Hat:enterprise_linux:7::computenode |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gdm-debuginfoRed Hat:enterprise_linux:7::computenode |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gdm-develRed Hat:enterprise_linux:7::computenode |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-sessionRed Hat:enterprise_linux:7::computenode |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-custom-sessionRed Hat:enterprise_linux:7::computenode |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-xsessionRed Hat:enterprise_linux:7::computenode |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdm-debuginfoRed Hat:enterprise_linux:7::server |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gdm-develRed Hat:enterprise_linux:7::server |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-session-custom-sessionRed Hat:enterprise_linux:7::server |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-debuginfoRed Hat:enterprise_linux:7::server |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdmRed Hat:enterprise_linux:7::server |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-sessionRed Hat:enterprise_linux:7::server |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-xsessionRed Hat:enterprise_linux:7::server |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdm-debuginfoRed Hat:enterprise_linux:7::workstation |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gdm-develRed Hat:enterprise_linux:7::workstation |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-session-custom-sessionRed Hat:enterprise_linux:7::workstation |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdmRed Hat:enterprise_linux:7::workstation |
before 1:3.22.3-11.el7 | 1:3.22.3-11.el7 |
gnome-sessionRed Hat:enterprise_linux:7::workstation |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gnome-session-xsessionRed Hat:enterprise_linux:7::workstation |
before 0:3.22.3-4.el7 | 0:3.22.3-4.el7 |
gdmopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.22.1-1.2 | 3.22.1-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7496 is a high vulnerability (CVSS 7.2) in Gnome Display Manager, published November 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in gdm3 3.18.2-1.
References
lists.fedoraproject.org/pipermail/package-announce/2015-November/172328.html
openwall.com/lists/oss-security/2015/11/17/10
access.redhat.com/errata/RHSA-2017:2128
download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news
bugzilla.gnome.org/show_bug.cgi?id=758032
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-7496
github.com/advisories/GHSA-qwh9-f2h4-mw38
security-tracker.debian.org/tracker/CVE-2015-7496
advisories.mageia.org/MGASA-2017-0248.html
bugs.mageia.org/show_bug.cgi?id=21450
bugzilla.redhat.com/show_bug.cgi?id=1273156
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2128.json
cve.org/CVERecord?id=CVE-2015-7496
ubuntu.com/security/CVE-2015-7496
suse.com/security/cve/CVE-2011-1709