- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 2 days
The published process acknowledges within two business days and assigns CVEs through Red Hat Product Security.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Web 1
- https://gitlab.gnome.org/GNOME/gdm
Products and areas 13
- Automatic login and timed login handling, including the window between boot and an authenticated session
- Configuration file parsing, custom.conf handling and the session and language selection data read from user-writable locations
- GNOME's security process publishes no component scope list. It takes a private report on any GNOME project through a single form, so the whole GDM tree below is inside it and nothing narrower is carved out
- PAM integration and the authentication conversation, including how a result from a PAM module is interpreted and what happens on partial or repeated failure
- Smartcard, fingerprint and other alternative authentication paths GDM wires into PAM
- The D-Bus interfaces GDM exposes on the system bus and what an unprivileged local client can reach through them
- The GDM daemon itself, which runs as root and supervises every graphical session on the machine
- The greeter path in full: how the login screen is launched, what it is allowed to do before authentication and what it inherits from the daemon
- The switch-user and user-switching flow, where two sessions exist at once and one of them is locked
- The unlock path after a session is locked, and the handoff between the session's own lock and GDM's
- The X11 and Wayland session setup GDM performs, including display server launch, authority file handling and the environment handed to the new session
- User and seat handling through logind and accountsservice, covering the user list shown on the greeter, session registration and multi-seat configurations
- Xauth cookie generation and file handling, and anything else GDM writes on a path a local user can influence
Out of scope (6)
- An administrator's configuration decision, such as enabling automatic login or displaying the user list, where GDM behaves as documented
- Attacks that require the attacker to already have a shell as the target user
- Distribution packaging and distro-specific GDM patches rather than upstream GDM
- GNOME Shell's own code, including the greeter session it provides. That belongs to the gnome-shell and mutter trees
- PAM modules themselves and the underlying pam library, which are separate upstreams
- systemd-logind, accountsservice and polkit as projects, though GDM's use of them is in scope
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
File through the report form at security.gnome.org. It opens a confidential issue on gitlab.gnome.org routed to the security team, and it is the documented private channel
-
Do not open an ordinary GitLab issue. A normal issue on gitlab.gnome.org is world-readable the moment it is filed
-
GitHub private vulnerability reporting is disabled on the GNOME mirrors, so the advisory button there is not a route into this process
-
State whether the defect is in GDM itself or in the GNOME Shell greeter session GDM launches. The greeter is a separate tree and the fix lands in a different place
-
Record the distribution and its GDM configuration. Automatic login, user list display and the smartcard and fingerprint options are all distribution choices that change what the greeter exposes
-
For anything on the unlock path, include the exact input sequence and timing. This class reproduces reliably or it does not reproduce at all
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-102559 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102560 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102555 | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when | High 8.2 | 29 Sep 2026 |
| CVE-2026-102558 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102557 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash. | High 8.6 | 29 Sep 2026 |
| CVE-2026-102556 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong. | High 8.6 | 29 Sep 2026 |
| CVE-2026-66337 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. | Medium 6.5 | 24 Jul 2026 |
| CVE-2026-66338 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. | Medium 5.4 | 24 Jul 2026 |
| CVE-2026-66339 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. | Medium 6.5 | 24 Jul 2026 |
| CVE-2026-12548 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents. | Medium 4.2 | 21 Jul 2026 |
| CVE-2026-58014 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. | High 7.3 | 30 Jun 2026 |
| CVE-2026-58015 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a | Medium 5.9 | 30 Jun 2026 |
| CVE-2026-58016 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of s | High 7.5 | 30 Jun 2026 |
| CVE-2026-58010 | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58011 | A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58012 | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 b | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-58013 | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. | Medium 6.5 | 30 Jun 2026 |
| CVE-2026-13601 | A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML in | High 7.1 | 29 Jun 2026 |
| CVE-2026-12549 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding. | Medium 4.8 | 22 Jun 2026 |
| CVE-2026-1766 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which caus | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-1767 | A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length calculation during the parsing of performer tags can lead to a read beyond the allocated buffer, potentiall | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-1764 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it co | Medium 5.6 | 16 Jun 2026 |
| CVE-2026-2708 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values. | Low 3.7 | 23 Apr 2026 |
| CVE-2026-5201 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of servi | High 7.5 | 31 Mar 2026 |
| CVE-2026-5119 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the initial HTTP CONNECT request. A network-positioned attacker or a malicious HTTP proxy can intercept these cookies, leading to potential session hijacking or user impersonation. | Medium 5.9 | 30 Mar 2026 |
| CVE-2026-2436 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service. | Medium 6.5 | 26 Mar 2026 |
| CVE-2026-2369 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service. | Medium 6.5 | 19 Mar 2026 |
| CVE-2026-4271 | A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application inst | Medium 5.3 | 17 Mar 2026 |
| CVE-2026-3633 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection. | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3634 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3632 | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could | Low 3.9 | 17 Mar 2026 |
| CVE-2026-3099 | A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attacker to capture a single valid authentication header and replay it repeatedly. Consequently, the attacker can bypass authentication and gain u | Medium 5.8 | 12 Mar 2026 |
| CVE-2026-2443 | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a ser | Medium 5.3 | 13 Feb 2026 |
| CVE-2026-1801 | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or | Medium 5.3 | 3 Feb 2026 |
| CVE-2026-1536 | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitti | Medium 5.8 | 28 Jan 2026 |
| CVE-2026-1539 | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications usin | Medium 5.8 | 28 Jan 2026 |
| CVE-2026-1467 | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or | Medium 5.8 | 27 Jan 2026 |
| CVE-2025-14512 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values. | Medium 6.5 | 11 Dec 2025 |
| CVE-2025-14087 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. | Medium 5.6 | 10 Dec 2025 |
| CVE-2025-13601 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. | High 7.7 | 26 Nov 2025 |
| CVE-2025-4056 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines. | High 7.5 | 28 Jul 2025 |
| CVE-2025-6196 | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote a | Medium 5.5 | 17 Jun 2025 |
| CVE-2025-6199 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output size to the full buffer length rather than the actual number of written bytes. This logic error results in uninitialized sections of the buffer being included in the output, potentially leaking arbitrary memory contents in the processed ima | Low 3.3 | 17 Jun 2025 |
| CVE-2025-6052 | A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption. | Low 3.7 | 13 Jun 2025 |
| CVE-2023-5616 | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user. | Medium 4.9 | 15 Apr 2025 |
| CVE-2025-3155 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. | High 7.4 | 3 Apr 2025 |
| CVE-2025-2784 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server. | High 7.0 | 3 Apr 2025 |
| CVE-2022-1736 | Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default. | Critical 9.8 | 31 Jan 2025 |
| CVE-2023-43091 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code. | Critical 9.8 | 17 Nov 2024 |
| CVE-2024-52533 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character. | Critical 9.8 | 11 Nov 2024 |
| CVE-2024-52530 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. | High 7.5 | 11 Nov 2024 |
| CVE-2024-52531 | GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. There is a plausible way to reach this remotely via soup_message_headers_get_content_type (e.g., an application may want to retrieve the content type of a request or response). | Medium 6.5 | 11 Nov 2024 |
| CVE-2024-52532 | GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clients. | High 7.5 | 11 Nov 2024 |
| CVE-2024-42415 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to tri | High 8.4 | 3 Oct 2024 |
| CVE-2024-36474 | An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. | High 8.4 | 3 Oct 2024 |
| CVE-2024-34397 | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to th | Medium 5.2 | 7 May 2024 |
| CVE-2020-36774 | plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). | Medium 5.5 | 19 Feb 2024 |
| CVE-2022-48622 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c. | High 7.8 | 26 Jan 2024 |
| CVE-2023-5557 | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. | High 7.5 | 13 Oct 2023 |
| CVE-2023-43090 | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. | Medium 5.5 | 22 Sep 2023 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview GDM is the GNOME Display Manager, the login and lock screen shipped by default on Fedora, RHEL, Debian and Ubuntu's GNOME sessions. It runs as root at the console before anyone has authenticated, and it owns the unlock path afterwards. That makes it one of the shortest routes from standing at a keyboard to a root shell, and pre-authentication code on the greeter is the whole reason a small codebase earns attention. GNOME's bug bounty is defunct and GDM was never covered by it in the first place, so sorona.xyz pays you directly on qualified, reproduced findings. In scope GNOME's security process publishes no component scope list. It takes a private report on any GNOME project through a single form, so the whole GDM tree below is inside it and nothing narrower is carved out The GDM daemon itself, which runs as root and supervises every graphical session on the machine The greeter path in full: how the login screen is launched, what it is allowed to do before authentication and what it inherits from the daemon PAM integration and the authentication conversation, including how a result from a PAM module is interpreted and what happens on partial or repeated failure The unlock path after a session is locked, and the handoff between the session's own lock and GDM's User and seat handling through logind and accountsservice, covering the user list shown on the greeter, session registration and multi-seat configurations The switch-user and user-switching flow, where two sessions exist at once and one of them is locked Automatic login and timed login handling, including the window between boot and an authenticated session Smartcard, fingerprint and other alternative authentication paths GDM wires into PAM The X11 and Wayland session setup GDM performs, including display server launch, authority file handling and the environment handed to the new session Xauth cookie generation and file handling, and anything else GDM writes on a path a local user can influence The D-Bus interfaces GDM exposes on the system bus and what an unprivileged local client can reach through them Configuration file parsing, custom.conf handling and the session and language selection data read from user-writable locations Out of scope GNOME Shell's own code, including the greeter session it provides. That belongs to the gnome-shell and mutter trees PAM modules themselves and the underlying pam library, which are separate upstreams systemd-logind, accountsservice and polkit as projects, though GDM's use of them is in scope An administrator's configuration decision, such as enabling automatic login or displaying the user list, where GDM behaves as documented Attacks that require the attacker to already have a shell as the target user Distribution packaging and distro-specific GDM patches rather than upstream GDM Most-valued findings Anything that reaches code execution from the greeter before authentication. GDM is root at the console, so this is the highest-severity shape available here Lock-screen and unlock defects that let someone at the keyboard reach a live session on a machine the owner locked Authentication logic that treats a failed, cancelled or partial PAM conversation as success, or that lets a second attempt inherit state from the first Switch-user and multi-seat handling where a locked session becomes reachable from a second seat or from the greeter Privilege escalation from the greeter user to root, since the greeter deliberately runs unprivileged while the daemon above it does not File handling on paths a local user controls: Xauth cookies, session files, temporary directories and anything GDM writes as root into a shared location Session environment handling where a variable or descriptor from the greeter survives into the authenticated session System D-Bus methods an unprivileged local client can invoke to affect another user's session Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. File through the report form at security.gnome.org. It opens a confidential issue on gitlab.gnome.org routed to the security team, and it is the documented private channel Do not open an ordinary GitLab issue. A normal issue on gitlab.gnome.org is world-readable the moment it is filed GitHub private vulnerability reporting is disabled on the GNOME mirrors, so the advisory button there is not a route into this process State whether the defect is in GDM itself or in the GNOME Shell greeter session GDM launches. The greeter is a separate tree and the fix lands in a different place Record the distribution and its GDM configuration. Automatic login, user list display and the smartcard and fingerprint options are all distribution choices that change what the greeter exposes For anything on the unlock path, include the exact input sequence and timing. This class reproduces reliably or it does not reproduce at all There is no money at any stage. The GNOME bounty that once ran on YesWeHack is gone, and its scope only ever covered GLib and libsoup Disclosure Report through the security.gnome.org form, which opens a confidential issue visible to a small security team on gitlab.gnome.org. The published process acknowledges within two business days and assigns CVEs through Red Hat Product Security. Confidentiality runs until a fix is committed to the git repository or ninety days pass, whichever comes first. Enterprise distributions carry GDM for years, so the practical exposure window after a fix is long and the backport matters as much as the upstream commit. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability