kf5-kauth -- Insecure handling of arguments in helpers

Albert Astals Cid reports: KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus. Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugin...

The vulnerability of the dbus package in the Astra Linux operating system allows a hacker to increase their privileges.

The vulnerability of the dbus package in the Astra Linux operating system relates to the ability for a root user with low integrity levels to access the session bus of a root user with high integrity levels. Exploiting this vulnerability could allow an attacker to enhance their privileges...

Security Bulletin: Vulnerabilities in dbus affect the IBM Flex System Manager (FSM) (CVE-2014-3638, CVE-2014-3639, CVE-2014-3477)

Summary Vulnerabilities in dbus affect the IBM Flex System Manager FSM CVE-2014-3638, CVE-2014-3639, CVE-2014-3477 Vulnerability Details Abstract Vulnerabilities in dbus affect the IBM Flex System Manager FSM CVE-2014-3638, CVE-2014-3639, CVE-2014-3477 Content Vulnerability Details: CVE-ID:...

CVE-2019-6498

GattLib 0.2 has a stack-based buffer over-read in gattlibconnect in dbus/gattlib.c because strncpy is misused...

Stack overflow

GattLib 0.2 has a stack-based buffer over-read in gattlibconnect in dbus/gattlib.c because strncpy is misused...

CVE-2019-6498

GattLib 0.2 has a stack-based buffer over-read in gattlibconnect in dbus/gattlib.c because strncpy is misused...

PT-2019-18120

Name of the Vulnerable Software and Affected Versions GattLib version 0.2 Description The issue is related to a stack-based buffer over-read in the gattlib connect function, located in dbus/gattlib.c, due to the misuse of strncpy. Recommendations For GattLib version 0.2, at the moment, there is n...

CVE-2019-6498: Out-of-bounds Read

GattLib 0.2 has a stack-based buffer over-read in gattlibconnect in dbus/gattlib.c because strncpy is misused...

PT-2019-20122

Name of the Vulnerable Software and Affected Versions GattLib version 0.2 Description The issue is related to a stack-based buffer over-read in the gattlib connect function, located in dbus/gattlib.c, due to the misuse of strncpy. Recommendations For GattLib version 0.2, consider applying a patch...

blueman - set_dhcp_handler D-Bus Privilege Escalation Exploit

Exploit for linux platform in category local exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'blueman setdhcphandler D-Bus Privilege Escalation', 'Description' = %q This module attempts...

Sandbox Restrictions Bypass

flatpak is vulnerable to sandbox restrictions escape. The whitespace handling in the proxy is not identical to whitespace handling in dbus-proxy/flatpak-proxy.c, allowing an attacker to break out of the sandbox via malicious D-Bus messages to the host...

Arbitrary Code Execution

dbus is vulnerable to arbitrary code execution attacks. The vulnerability exists as libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUSSYSTEMBUSADDRESS...

polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork

polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork / When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt bein...

Linux Kernel 4.15.x 4.19.2 - map_write() CAP_SYS_ADMIN Local Privilege Escalation (dbus Method)

Linux Kernel 4.15.x 4.19.2 - mapwrite CAPSYSADMIN Local Privilege Escalation dbus Method !/bin/sh EDB Note: Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47165.zip wrapper for Jann Horn's exploit for CVE-2018-18955 uses dbus service technique ---...

Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method)

!/bin/sh EDB Note: Download https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47165.zip wrapper for Jann Horn's exploit for CVE-2018-18955 uses dbus service technique --- test@linux-mint-19-2:/kernel-exploits/CVE-2018-18955$ ./exploit.dbus.sh Compiling... Creating...

Fedora 29 : systemd (2018-c402eea18b)

Fix a local vulnerability from a race condition in chown-recursive CVE-2018-15687, 1639076 - Fix a local vulnerability from invalid handling of long lines in state deserialization CVE-2018-15686, 1639071 - Fix a remote vulnerability in DHCPv6 in systemd-networkd CVE-2018-15688, 1639067 - The DHCP...

PT-2018-2328

Name of the Vulnerable Software and Affected Versions Astra Linux affected versions not specified Description The issue in Astra Linux's dbus package is related to the possibility of a root user with low integrity level connecting to the session bus of a root user with high integrity level. This...

PT-2018-19317

Уязвимость компоненты графического входа пользователя в систему fly-dm операционной системы Astra Linux связана с ошибкой, приводящей к запуску компоненты fly-mac-dialog без опции DBUS SESSION BUS ADDRESS=nothing, необходимой для запуска демона dbus с высоким уровнем целостности. Эксплуатация...

SUSE SLES11 Security Update : glib2 (SUSE-SU-2018:3966-1)

This update for glib2 fixes the following issues : Security issues fixed : CVE-2018-16429: Fixed out-of-bounds read vulnerability ingmarkupparsecontextparse bsc1107116. Fixing potentially exploitable bugs in UTF-8 validation in Variant and DBUS message parsing bsc1111499. Note that Tenable Networ...

SUSE-SU-2018:3966-1 Security update for glib2

This update for glib2 fixes the following issues: Security issues fixed: - CVE-2018-16429: Fixed out-of-bounds read vulnerability ingmarkupparsecontextparse bsc1107116. - Fixing potentially exploitable bugs in UTF-8 validation in Variant and DBUS message parsing bsc1111499...