CVE-2014-3637: Low severity freedesktop d-bus vulnerability

Published Sep 22, 2014

Updated

D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.

Affected Software

79 affected components

Freedesktop dbus=1.3.0

Freedesktop dbus=1.3.1

Freedesktop dbus=1.4.0

Freedesktop dbus=1.4.1

Freedesktop dbus=1.4.4

Freedesktop dbus=1.4.6

Freedesktop dbus=1.4.8

Freedesktop dbus=1.4.10

Freedesktop dbus=1.4.12

Freedesktop dbus=1.4.14

Freedesktop dbus=1.4.16

Freedesktop dbus=1.4.18

Freedesktop dbus=1.4.20

Freedesktop dbus=1.4.22

Freedesktop dbus=1.4.24

Freedesktop dbus=1.4.26

Freedesktop dbus=1.5.0

Freedesktop dbus=1.5.2

Freedesktop dbus=1.5.4

Freedesktop dbus=1.5.6

Freedesktop dbus=1.5.8

Freedesktop dbus=1.5.10

Freedesktop dbus=1.5.12

Freedesktop dbus=1.6.0

Freedesktop dbus=1.6.2

Freedesktop dbus=1.6.4

Freedesktop dbus=1.6.6

Freedesktop dbus=1.6.8

Freedesktop dbus=1.6.10

Freedesktop dbus=1.6.12

Freedesktop dbus=1.6.14

Freedesktop dbus=1.6.16

Freedesktop dbus=1.6.18

Freedesktop dbus=1.6.20

Freedesktop dbus=1.6.22

Freedesktop dbus=1.8.0

Freedesktop dbus=1.8.2

Freedesktop dbus=1.8.4

Freedesktop dbus=1.8.6

openSUSE openSUSE=12.3

D-bus Project D-bus=1.3.0

D-bus Project D-bus=1.3.1

D-bus Project D-bus=1.4.0

D-bus Project D-bus=1.4.1

D-bus Project D-bus=1.4.4

D-bus Project D-bus=1.4.6

D-bus Project D-bus=1.4.8

D-bus Project D-bus=1.4.10

D-bus Project D-bus=1.4.12

D-bus Project D-bus=1.4.14

D-bus Project D-bus=1.4.16

D-bus Project D-bus=1.4.18

D-bus Project D-bus=1.4.20

D-bus Project D-bus=1.4.22

D-bus Project D-bus=1.4.24

D-bus Project D-bus=1.4.26

D-bus Project D-bus=1.5.0

D-bus Project D-bus=1.5.2

D-bus Project D-bus=1.5.4

D-bus Project D-bus=1.5.6

D-bus Project D-bus=1.5.8

D-bus Project D-bus=1.5.10

D-bus Project D-bus=1.5.12

D-bus Project D-bus=1.6.0

D-bus Project D-bus=1.6.2

D-bus Project D-bus=1.6.4

D-bus Project D-bus=1.6.6

D-bus Project D-bus=1.6.8

D-bus Project D-bus=1.6.10

D-bus Project D-bus=1.6.12

D-bus Project D-bus=1.6.14

D-bus Project D-bus=1.6.16

D-bus Project D-bus=1.6.18

D-bus Project D-bus=1.6.20

D-bus Project D-bus=1.6.22

D-bus Project D-bus=1.8.0

D-bus Project D-bus=1.8.2

D-bus Project D-bus=1.8.4

D-bus Project D-bus=1.8.6

Remediation

Patch Available

https://bugs.freedesktop.org/show_bug.cgi?id=80559

Event History

Sep 22, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3637?

CVE-2014-3637 has a medium severity rating due to its potential to allow local users to cause denial of service.

How do I fix CVE-2014-3637?

To mitigate CVE-2014-3637, upgrade D-Bus to version 1.6.24 or later or 1.8.8 or later.

What versions are affected by CVE-2014-3637?

CVE-2014-3637 affects D-Bus versions from 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8.

What type of vulnerability is CVE-2014-3637?

CVE-2014-3637 is a local denial of service vulnerability related to improper connection handling in D-Bus.

Can CVE-2014-3637 be exploited remotely?

CVE-2014-3637 cannot be exploited remotely as it requires local user access to trigger the vulnerability.