USN-8701-1: UDisks vulnerability

It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary...

SUSE-SU-2026:23405-1 Security update for udisks2

This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method can lead to local privilege escalation bsc1274430...

OPENSUSE-SU-2026:21704-1 Security update for udisks2

This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method can lead to local privilege escalation bsc1274430...

NimbusPWN-CVE-2022-29799-29800

🛡️ NimbusPWN-CVE-2022-29799-29800 – Testen lokaler Privilegienausweitungs-Sicherheitslücken 📖 Über dieses Werkzeug Diese Software hilft Sicherheitsforschern, zwei spezifische Schwachstellen zu untersuchen, die als CVE-2022-29799 und CVE-2022-29800 bekannt sind. Diese Fehler existieren in der...

CVE-2026-81704

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81686

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

EUVD-2026-67060

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81704

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler. The affected code uses unstretched SHA-256 instead of Argon2id , omitting key stretching and hash rounds. This allows attackers to perform offline password guessing ag...

CVE-2026-81704 openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

EUVD-2026-67042

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686 openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

opensslencrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations to...

CVE-2026-81686

openssl_encrypt 1.4.x before 1.4.9 ships an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can set MaxConcurrentOperations to 0/negative (blocking all subsequent op...

PT-2026-82605

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The D-Bus CryptoService.EncryptFile handler uses unstretched SHA-256 instead of Argon2id for key derivation. This allows attackers to perform offline password guessing against encrypted files...

CentOS 9 : glib2-2.68.4-29.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glib2-2.68.4-29.el9 build changelog. - heap under-read in gkeyfilegetlocalestringlist CVE-2026-58014 - limit D-Bus auth line read length CVE-2026-15588 - off-by-one error in...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.12)

The version of AOS installed on the remote host is prior to 7.5.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.12 advisory. - A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file...

CVE-2026-61898

A flaw was found in accountsservice. A local attacker can exploit this by injecting arbitrary shell commands into the user-controlled LANGUAGE entry in the /.pamenvironment file. The Ubuntu-specific language helper scripts process this input unescaped, leading to arbitrary code execution with roo...

Astra Linux – Vulnerability in Dbus

A issue was discovered in D-Bus before 1.12.24, 1.13.x, and 1.14.x, before 1.14.4, and 1.15.x, before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where the array length is inconsistent with the size of the element...

CVE-2026-61898

The Ubuntu-specific language helper scripts save-to-pam-env, update-langlist shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in /.pamenvironment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an...