CVE Feed

    Dashboard / CVE / CVE-2014-3637

    CVE-2014-3637

    D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.

    Published:Sep 16, 2014
    Last Modified:Apr 12, 2025
    EPS:Sep 22, 2014
    EPSS Score:0.00067
    CVSS Score:2.1

    Affected Products

    Vendor
    Freedesktop
    Product
    Dbus
    Vendor
    Opensuse
    Product
    Opensuse

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-34969 (CVSS 6.5) — D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with contro…
    CVE-2022-42010 (CVSS 6.5) — An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An…
    CVE-2022-42012 (CVSS 6.5) — An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An…
    CVE-2022-42011 (CVSS 6.5) — An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An…
    CVE-2020-35512 (CVSS 7.8) — A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, …
    CVE-2020-12049 (CVSS 5.5) — An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, le…
    CVE-2019-12749 (CVSS 7.1) — dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upst…
    CVE-2015-0245 (CVSS 1.9) — D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the so…
    CVE-2014-7824 (CVSS 2.1) — D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cau…
    CVE-2014-3636 (CVSS 1.9) — D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of ser…

    References

    http://advisories.mageia.org/MGASA-2014-0395.html
    http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
    http://secunia.com/advisories/61378
    http://www.debian.org/security/2014/dsa-3026
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
    http://www.openwall.com/lists/oss-security/2014/09/16/9
    http://www.openwall.com/lists/oss-security/2019/06/24/13
    http://www.openwall.com/lists/oss-security/2019/06/24/14
    http://www.securitytracker.com/id/1030864
    http://www.ubuntu.com/usn/USN-2352-1
    https://bugs.freedesktop.org/show_bug.cgi?id=80559
    http://advisories.mageia.org/MGASA-2014-0395.html
    http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
    http://secunia.com/advisories/61378
    http://www.debian.org/security/2014/dsa-3026
    http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
    http://www.openwall.com/lists/oss-security/2014/09/16/9
    http://www.openwall.com/lists/oss-security/2019/06/24/13
    http://www.openwall.com/lists/oss-security/2019/06/24/14
    http://www.securitytracker.com/id/1030864
    http://www.ubuntu.com/usn/USN-2352-1
    https://bugs.freedesktop.org/show_bug.cgi?id=80559

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High