libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade dbus-docUpgrade dbus-x11Upgrade dbus-develUpgrade dbus-libsUpgrade dbus | Dec 1, 2016 | Sep 18, 2012 |
| Debian | — | Upgrade glib2.0Upgrade dbus | Jul 30, 2024 | Sep 18, 2012 |
| Gentoo Linux | — | Upgrade dev-libs/glib.Upgrade sys-apps/dbus. | Oct 30, 2017 | Sep 18, 2012 |
| Oracle Solaris | — | Upgrade system/library/libdbus to version 1.2.28-0.175.0.12.0.4.0 on Solaris 11.0Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | May 29, 2017 | Sep 18, 2012 |
| Oracle_linux | — | Upgrade dbus-x11Upgrade dbus-docUpgrade dbus-libsUpgrade dbusUpgrade dbus-devel | Oct 16, 2024 | Sep 18, 2012 |
| Suse | — | Upgrade dbus-1-toolsUpgrade dbus-1-develUpgrade glib2-langUpgrade dbus-1-32bitUpgrade typelib-1_0-GObject-2_0Upgrade dbus-1-x86Upgrade libdbus-1-3Upgrade glib2-develUpgrade dbus-1Upgrade dbus-1-commonUpgrade dbus-1-x11Upgrade libgobject-2_0-0Upgrade libgthread-2_0-0-32bitUpgrade typelib-1_0-GIRepository-3_0Upgrade dbus-1-devel-docUpgrade libgmodule-2_0-0Upgrade libgio-2_0-0Upgrade libgirepository-2_0-0Upgrade glib2-toolsUpgrade glib2-docUpgrade libglib-2_0-0Upgrade libgobject-2_0-0-32bitUpgrade libdbus-1-3-32bitUpgrade glib2-devel-staticUpgrade libgio-famUpgrade typelib-1_0-Gio-2_0Upgrade typelib-1_0-GLib-2_0Upgrade libgmodule-2_0-0-32bitUpgrade typelib-1_0-GLibUnix-2_0Upgrade libglib-2_0-0-32bitUpgrade libgio-2_0-0-32bitUpgrade dbus-1-daemonUpgrade typelib-1_0-GModule-2_0Upgrade libgthread-2_0-0 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade dbusUpgrade libdbus-1-3 | Nov 8, 2024 | Sep 18, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub