Multiple vulnerabilities have been found in D-Bus, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.14.4 | >= 1.14.4 |
D-Bus is a daemon providing a framework for applications to communicate with one another.
Multiple vulnerabilities have been discovered in D-Bus. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.14.4"
A local Denial of Service vulnerability was discovered in D-Bus.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.12.20 | >= 1.12.20 |
D-Bus is a message bus system which processes can use to talk to each other.
It was discovered that D-Bus did not properly handle the situation when two usernames have the same numeric UID.
An attacker could possibly cause a Denial of Service condition or trigger other undefined behavior, possibly including incorrect authorization decisions.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.12.20"
A local Denial of Service vulnerability was discovered in D-Bus.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.12.18 | >= 1.12.18 |
D-Bus is a message bus system which processes can use to talk to each other.
D-Bus does not correctly dispose of old connections meaning that it is possible for D-Bus to hit a connection limit.
An attacker could cause a possible Denial of Service condition.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.12.18"
An authentication bypass was discovered in D-Bus.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.12.16 | >= 1.12.16 |
D-Bus is a message bus system which processes can use to talk to each other.
It was discovered that a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges.
A local attacker can bypass authentication mechanisms and elevate privileges.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.12.16"
Multiple vulnerabilities in D-Bus might allow an attacker to overwrite files with a fixed filename in arbitrary directories or conduct a symlink attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.10.18 | >= 1.10.18 |
D-Bus is a message bus system which processes can use to talk to each other.
Multiple vulnerabilities have been discovered in D-Bus. Please review the original report referenced below for details.
An attacker could possibly overwrite arbitrary files named “once” with content not controlled by the attacker.
A local attacker could perform a symlink attack against D-Bus’ test suite.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.10.18"
A vulnerability has been found in D-Bus possibly resulting in a local Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.10.12 | >= 1.10.12 |
D-Bus is a message bus system, a simple way for applications to talk to one another.
It was discovered that D-Bus incorrectly handles certain format strings.
The impact of this new vulnerability is believed to not be exploitable if D-Bus is patched against CVE-2015-0245. The previous vulnerability (CVE-2015-0245) was addressed in GLSA-201503-02 referenced below.
A local attacker could cause a Denial of Service condition or possibly execute arbitrary code.
The vulnerable D-Bus interface is intended only for use by systemd running as root.
The administrator can install a policy which denies sending from org.freedesktop.systemd1.Activator” to D-Bus. This will prevent non-root attackers from reaching the interface in order to exercise this flaw.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.10.12"
A vulnerability has been found in D-Bus, possibly resulting in local Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.8.16 | >= 1.8.16 |
D-Bus is a message bus system, a simple way for applications to talk to one another.
D-Bus doesn’t validate the source of ActivationFailure signals.
A local attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.8.16"
Multiple vulnerabilities have been found in D-Bus, possibly resulting in local Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.8.10 | >= 1.8.10 |
D-Bus is a message bus system, a simple way for applications to talk to one another.
Multiple vulnerabilities have been discovered in D-Bus. Please review the CVE identifiers referenced below for details.
A local attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.8.10"
A vulnerability has been found in D-Bus which allows local attackers to gain escalated privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/glib | * | < 2.32.4-r1 | >= 2.32.4-r1 |
| sys-apps/dbus | * | < 1.6.8 | >= 1.6.8 |
D-Bus is a daemon providing a framework for applications to communicate with one another. GLib is a library providing a number of GNOME’s core objects and functions.
When libdbus is used in a setuid program, a user can gain escalated privileges by leveraging the DBUS_SYSTEM_BUS_ADDRESS variable. GLib can be used in a setuid context with D-Bus, and so can trigger this vulnerability. Please review the CVE identifier below for more details.
A local attacker could gain escalated privileges and execute arbitrary code.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.6.8"
All GLib users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.32.4-r1"
A vulnerability has been found in D-Bus which allows a local user to cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.6.12 | >= 1.6.12 |
D-Bus is a message bus system which processes can use to talk to each other.
D-Bus’ _dbus_printf_string_upper_bound() function crashes if it returns exactly 1024 bytes.
A local attacker could provide specially-crafted input to an application using D-Bus which would cause _dbus_printf_string_upper_bound() to return 1024 bytes and crash, causing a Denial of Service condition.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.6.12"
Multiple vulnerabilities were found in D-Bus, the worst of which allowing for a symlink attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.4.12 | >= 1.4.12 |
D-Bus is a message bus system, a simple way for applications to talk to each other.
Multiple vulnerabilities have been discovered in D-Bus. Please review the CVE identifiers referenced below for details.
The vulnerabilities allow for local Denial of Service (daemon crash), or arbitrary file overwriting.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.4.12"
An error condition can cause D-Bus to crash.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/dbus | * | < 1.2.3-r1 | >= 1.2.3-r1 |
D-Bus is a daemon providing a framework for applications to communicate with one another.
schelte reported that the dbus_signature_validate() function can trigger a failed assertion when processing a message containing a malformed signature.
A local user could send a specially crafted message to the D-Bus daemon, leading to a Denial of Service.
There is no known workaround at this time.
All D-Bus users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.2.3-r1"