Lucene search

RedhatCVE-2014-3635

HistorySep 22, 2014 - 3:55 p.m.

CVE-2014-3635

2014-09-2215:55:07

CWE-119

redhat

web.nvd.nist.gov

cve-2014-3635

d-bus

security vulnerability

denial of service

arbitrary code execution

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.

Affected configurations

Nvd

Node

d-bus_projectd-busRange≤1.6.22

freedesktopdbusMatch1.6.0

freedesktopdbusMatch1.6.2

freedesktopdbusMatch1.6.4

freedesktopdbusMatch1.6.6

freedesktopdbusMatch1.6.8

freedesktopdbusMatch1.6.10

freedesktopdbusMatch1.6.12

freedesktopdbusMatch1.6.14

freedesktopdbusMatch1.6.16

freedesktopdbusMatch1.6.18

freedesktopdbusMatch1.6.20

freedesktopdbusMatch1.8.0

freedesktopdbusMatch1.8.2

freedesktopdbusMatch1.8.4

freedesktopdbusMatch1.8.6

Node

opensuseopensuseMatch12.3

VendorProductVersionCPE
d-bus_projectd-bus*cpe:2.3:a:d-bus_project:d-bus:*:*:*:*:*:*:*:*
freedesktopdbus1.6.0cpe:2.3:a:freedesktop:dbus:1.6.0:*:*:*:*:*:*:*
freedesktopdbus1.6.2cpe:2.3:a:freedesktop:dbus:1.6.2:*:*:*:*:*:*:*
freedesktopdbus1.6.4cpe:2.3:a:freedesktop:dbus:1.6.4:*:*:*:*:*:*:*
freedesktopdbus1.6.6cpe:2.3:a:freedesktop:dbus:1.6.6:*:*:*:*:*:*:*
freedesktopdbus1.6.8cpe:2.3:a:freedesktop:dbus:1.6.8:*:*:*:*:*:*:*
freedesktopdbus1.6.10cpe:2.3:a:freedesktop:dbus:1.6.10:*:*:*:*:*:*:*
freedesktopdbus1.6.12cpe:2.3:a:freedesktop:dbus:1.6.12:*:*:*:*:*:*:*
freedesktopdbus1.6.14cpe:2.3:a:freedesktop:dbus:1.6.14:*:*:*:*:*:*:*
freedesktopdbus1.6.16cpe:2.3:a:freedesktop:dbus:1.6.16:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
d-bus_project	d-bus	*	cpe:2.3:a:d-bus_project:d-bus::::::::
freedesktop	dbus	1.6.0	cpe:2.3:a:freedesktop:dbus:1.6.0:::::::*
freedesktop	dbus	1.6.2	cpe:2.3:a:freedesktop:dbus:1.6.2:::::::*
freedesktop	dbus	1.6.4	cpe:2.3:a:freedesktop:dbus:1.6.4:::::::*
freedesktop	dbus	1.6.6	cpe:2.3:a:freedesktop:dbus:1.6.6:::::::*
freedesktop	dbus	1.6.8	cpe:2.3:a:freedesktop:dbus:1.6.8:::::::*
freedesktop	dbus	1.6.10	cpe:2.3:a:freedesktop:dbus:1.6.10:::::::*
freedesktop	dbus	1.6.12	cpe:2.3:a:freedesktop:dbus:1.6.12:::::::*
freedesktop	dbus	1.6.14	cpe:2.3:a:freedesktop:dbus:1.6.14:::::::*
freedesktop	dbus	1.6.16	cpe:2.3:a:freedesktop:dbus:1.6.16:::::::*