Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2011-2533

dbus: Possibility of symlink attack in /tmp during compilation

The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Freedesktop
Products
Dbus
CVE-2013-0292

dbus-glib: Local privilege escalation due improper filtering of message sender when NameOwnerChanged signal received

The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

CVSS 2.0 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Freedesktop Redhat
Products
Dbus-glib Enterprise Linux
CVE-2013-2168

dbus: Crash of system services that use libdbus (DoS) due to non-portable use of va_list in UNIX format string wrapper

The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Freedesktop Opensuse
Products
Dbus Opensuse
CVE-2011-2200

dbus: Local DoS via messages with non-native byte order

The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
D-bus Project Freedesktop Redhat
Products
D-bus Dbus Enterprise Linux
CVE-2020-35512

dbus: users with the same numeric UID could lead to use-after-free and undefined behaviour

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Freedesktop Linux
Products
Dbus Linux Kernel
CVE-2020-12049

dbus: denial of service via file descriptor leak

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Freedesktop Redhat
Products
Ubuntu Linux Dbus Enterprise Linux and 2 more