CVE-2014-3636: Low severity dbus vulnerability
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3636?
CVE-2014-3636 has been assessed as a denial of service vulnerability that can significantly disrupt local user operations.
How do I fix CVE-2014-3636?
To fix CVE-2014-3636, users should upgrade D-Bus to version 1.6.24 or later for the 1.6.x series or 1.8.8 or later for the 1.8.x series.
What systems are affected by CVE-2014-3636?
CVE-2014-3636 affects D-Bus versions 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8.
What type of attacks can CVE-2014-3636 enable?
CVE-2014-3636 can enable local users to conduct denial of service attacks by exhausting the maximum number of file descriptors or sending multiple messages.
Are there any workarounds for CVE-2014-3636?
While updating D-Bus is the primary solution for CVE-2014-3636, mitigating local user access could help reduce potential risk.