CVE-2014-7271

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm"...

7.8 HighFix available

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.40%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 7.8

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: CVE-2014-7271
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-306
Updated: 2026-11-02

CVE List No score

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: CVE-2014-7271
Updated: 2026-11-02

EUVDEUVD-2014-7142 No score

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: EUVD-2014-7142
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p422-626h-2hv4 7.8

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm"...

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: GHSA-p422-626h-2hv4
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-306
Updated: 2026-11-02

OSV 7.8

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: CVE-2014-7271
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-7271 7.8

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: DEBIAN-CVE-2014-7271
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-7271 7.8

Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.

Record: UBUNTU-CVE-2014-7271
CVSS 3.0: 7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2014-0504 No score

Updated sddm packages fix security vulnerabilities

Sddm may in some cases allow unauthenticated logins as the sddm user (CVE-2014-7271).

Sddm is vulnerable to a race condition in XAUTHORITY file generation (CVE-2014-7272).

Sddm has been updated to version 0.10.0, fixing these issues and several other bugs, and adding new functionality.

libxcb packages have been updated to work with sddm.

Record: MGASA-2014-0504
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10135-1 No score

sddm-0.14.0-2.1 on GA media

These are all security issues fixed in the sddm-0.14.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10135-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`sddm` Debian:12	before 0.11.0-2	0.11.0-2
`sddm` Debian:13	before 0.11.0-2	0.11.0-2
`sddm` Debian:14	before 0.11.0-2	0.11.0-2
`sddm` Mageia:4	before 0.10.0-1.mga4	0.10.0-1.mga4
`libxcb` Mageia:4	before 1.9.1-2.1.mga4	1.9.1-2.1.mga4
`sddm` openSUSE:Tumbleweed	before 0.14.0-2.1	0.14.0-2.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7271 is a high vulnerability (CVSS 7.8) in Sddm Project Sddm, published December 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in sddm 0.11.0-2.

References

Show 14 moreShow less