KDM allows the user to select the session type for login. This setting is stored in the user home directory. Previous versions of KDM will follow a symbolic link and can thus disclose the contents of any file on the system (such as /etc/shadow) to arbitrary users. KDM is not the default window manager on rPath Linux.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/47631/rPSA-2006-0106-1.txt
Source: https://packetstormsecurity.com/files/47631/rPSA-2006-0106-1.txt.html