Lucene search

K
osvGoogleOSV:DSA-3161-1
HistoryFeb 11, 2015 - 12:00 a.m.

dbus - security update

2015-02-1100:00:00
Google
osv.dev
9

0.0004 Low

EPSS

Percentile

5.1%

Simon McVittie discovered a local denial of service flaw in dbus, an
asynchronous inter-process communication system. On systems with
systemd-style service activation, dbus-daemon does not prevent forged
ActivationFailure messages from non-root processes. A malicious local
user could use this flaw to trick dbus-daemon into thinking that systemd
failed to activate a system service, resulting in an error reply back to
the requester.

For the stable distribution (wheezy), this problem has been fixed in
version 1.6.8-1+deb7u6.

For the unstable distribution (sid), this problem has been fixed in
version 1.8.16-1.

We recommend that you upgrade your dbus packages.