Lucene search

K
osvGoogleOSV:ALSA-2022:6608
HistorySep 20, 2022 - 12:00 a.m.

Moderate: dbus-broker security update

2022-09-2000:00:00
Google
osv.dev
7
dbus-broker
security update
cve-2022-31212
cve-2022-31213
linux systems

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

50.0%

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.

Security Fix(es):

  • dbus-broker: a stack buffer over-read if a malicious Exec line is supplied (CVE-2022-31212)
  • dbus-broker: null pointer reference when supplying a malformed XML config file (CVE-2022-31213)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

50.0%