CVE Feed

    Dashboard / CVE / CVE-2014-3635

    CVE-2014-3635

    Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.

    Published:Sep 16, 2014
    Last Modified:Apr 12, 2025
    EPS:Sep 22, 2014
    EPSS Score:0.00173
    CVSS Score:4.4

    Affected Products

    Vendor
    D-bus Project
    Product
    D-bus
    Vendor
    Freedesktop
    Product
    Dbus
    Vendor
    Opensuse
    Product
    Opensuse

    Exploits

    No exploit reference

    Related CVEs

    CVE-2014-3638 (CVSS 2.1) — The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allo…
    CVE-2014-3636 (CVSS 1.9) — D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of ser…
    CVE-2014-3639 (CVSS 2.1) — The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which a…
    CVE-2014-3477 (CVSS 4) — The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDeni…
    CVE-2011-2200 (CVSS 4.6) — The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x bef…
    CVE-2010-4352 (CVSS 2.1) — Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of servi…

    References

    http://advisories.mageia.org/MGASA-2014-0395.html
    http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
    http://secunia.com/advisories/61378
    http://www.debian.org/security/2014/dsa-3026
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
    http://www.openwall.com/lists/oss-security/2014/09/16/9
    http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
    http://www.securitytracker.com/id/1030864
    http://www.ubuntu.com/usn/USN-2352-1
    https://bugs.freedesktop.org/show_bug.cgi?id=83622
    http://advisories.mageia.org/MGASA-2014-0395.html
    http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
    http://secunia.com/advisories/61378
    http://www.debian.org/security/2014/dsa-3026
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
    http://www.openwall.com/lists/oss-security/2014/09/16/9
    http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
    http://www.securitytracker.com/id/1030864
    http://www.ubuntu.com/usn/USN-2352-1
    https://bugs.freedesktop.org/show_bug.cgi?id=83622

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High