Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2023-1730

Related Vulnerabilities: CVE-2022-42010   CVE-2022-42011   CVE-2022-42012  

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. (CVE-2022-42010) An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. (CVE-2022-42011) An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Source

ALAS-2023-1730

Amazon Linux AMI Security Advisory: ALAS-2023-1730
Advisory Release Date: 2023-04-13 19:01 Pacific
Advisory Updated Date: 2023-04-20 20:01 Pacific
Severity: Medium
Issue Overview:

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. (CVE-2022-42010)

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. (CVE-2022-42011)

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)


Affected Packages:

dbus


Issue Correction:
Run yum update dbus to update your system.

New Packages:
i686:
    dbus-1.6.12-14.31.amzn1.i686
    dbus-devel-1.6.12-14.31.amzn1.i686
    dbus-libs-1.6.12-14.31.amzn1.i686
    dbus-debuginfo-1.6.12-14.31.amzn1.i686

noarch:
    dbus-doc-1.6.12-14.31.amzn1.noarch

src:
    dbus-1.6.12-14.31.amzn1.src

x86_64:
    dbus-1.6.12-14.31.amzn1.x86_64
    dbus-libs-1.6.12-14.31.amzn1.x86_64
    dbus-devel-1.6.12-14.31.amzn1.x86_64
    dbus-debuginfo-1.6.12-14.31.amzn1.x86_64

Additional References

Red Hat: CVE-2022-42010, CVE-2022-42011, CVE-2022-42012

Mitre: CVE-2022-42010, CVE-2022-42011, CVE-2022-42012

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started