Published: 25/10/2014 Updated: 27/12/2023

CVSS v2 Base Score: 1.9 | Impact Score: 2.9 | Exploitability Score: 3.4

VMScore: 169

Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P

D-Bus 1.3.0 up to and including 1.6.x prior to 1.6.24 and 1.8.x prior to 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.

Vulnerable Product	Search on Vulmon	Subscribe to Product
d-bus project d-bus
freedesktop dbus 1.8.0
freedesktop dbus 1.8.6
freedesktop dbus 1.8.4
freedesktop dbus 1.8.2
opensuse opensuse 12.3

Several security issues were fixed in DBus ...

Simon McVittie discovered that the fix for CVE-2014-3636 was incorrect, as it did not fully address the underlying denial-of-service vector This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count In addition, this update reverts the auth_timeout change in the previous security update to its o ...

Alban Crequy and Simon McVittie discovered several vulnerabilities in the D-Bus message daemon CVE-2014-3635 On 64-bit platforms, file descriptor passing could be abused by local users to cause heap corruption in dbus-daemon, leading to a crash, or potentially to arbitrary code execution CVE-2014-3636 A denial-of-service vulnerab ...

D-Bus 130 through 16x before 1624 and 18x before 188 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descrip ...

CWE-399 http://www.debian.org/security/2014/dsa-3026 http://secunia.com/advisories/61378 http://www.openwall.com/lists/oss-security/2014/09/16/9 https://bugs.freedesktop.org/show_bug.cgi?id=82820 http://www.ubuntu.com/usn/USN-2352-1 http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://advisories.mageia.org/MGASA-2014-0395.html http://www.securitytracker.com/id/1030864 https://usn.ubuntu.com/2352-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-3636

CVE-2014-3636

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect