dbus security update

2011-09-03T14:50:22
ID CESA-2011:1132
Type centos
Reporter CentOS Project
Modified 2011-09-22T06:00:27

Description

CentOS Errata and Security Advisory CESA-2011:1132

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.

A denial of service flaw was found in the way the D-Bus library handled endianness conversion when receiving messages. A local user could use this flaw to send a specially-crafted message to dbus-daemon or to a service using the bus, such as Avahi or NetworkManager, possibly causing the daemon to exit or the service to disconnect from the bus. (CVE-2011-2200)

All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2011-September/017794.html http://lists.centos.org/pipermail/centos-announce/2011-September/017795.html http://lists.centos.org/pipermail/centos-cr-announce/2011-September/000238.html http://lists.centos.org/pipermail/centos-cr-announce/2011-September/000239.html

Affected packages: dbus dbus-devel dbus-libs dbus-x11

Upstream details at: https://rhn.redhat.com/errata/RHSA-2011-1132.html