CVE-2014-0979 Null dereference in n/a
Local attackers can cause a denial of service in LightDM GTK+ Greeter by triggering a NULL pointer dereference with an empty username.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0979?
CVE-2014-0979 is a low-severity vulnerability in Opensuse Opensuse, published on 23 Jan 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username.
Which versions are affected by CVE-2014-0979?
It affects 2 products.
Products include Lightdm Gtk\+ Greeter Project Lightdm Gtk\+ Greeter, Opensuse Opensuse.
How do I fix CVE-2014-0979?
Upgrade to a fixed version.
Is CVE-2014-0979 being exploited?
There is no known exploitation of CVE-2014-0979 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2014-0979, GHSA-3wgq-2r52-v65w, MGASA-2014-0026.