The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade dbus | Jul 30, 2024 | Dec 10, 2008 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 5, 2008 |
| Suse | — | Upgrade dbus-1-devel-docUpgrade PackageKit-backend-zyppUpgrade dbus-1-x11Upgrade halUpgrade libpackagekit-glib2-develUpgrade PackageKitUpgrade PackageKit-langUpgrade hal-docUpgrade libdbus-1-3Upgrade dbus-1Upgrade dbus-1-commonUpgrade dbus-1-x86Upgrade dbus-1-toolsUpgrade yast2-core-develUpgrade PackageKit-develUpgrade dbus-1-develUpgrade libpackagekit-glib10Upgrade hal-develUpgrade typelib-1_0-PackageKitGlib-1_0Upgrade libpackagekit-glib10-develUpgrade libpackagekit-qt10Upgrade hal-x86Upgrade dbus-1-32bitUpgrade hal-32bitUpgrade libpackagekit-qt10-develUpgrade libpackagekit-glib2-18Upgrade dbus-1-daemonUpgrade yast2-coreUpgrade PackageKit-branding-upstream | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub