Fedora 26 : systemd (2017-6f8fcff58c)

systemd-detect-virt QEMU CPUID logic update - Fix cryptsetup devices disappearing when used for btrfs - Fix rfkill on some thinkpads - Extend dbus timeouts to handle slow dbus daemon startup - Fix systemd-resolved DOS with crafted NSEC packets LP1725351 - Backport /etc/crypttab netdev feature...

CVE-2017-5084

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

CVE-2017-5084

Removed by vendor...

CVE-2017-5084

CVE-2017-5084 detail (Google Chrome OS): In Chrome OS, the image-burner component exposed a BurnImage D-Bus endpoint with an inappropriate implementation, enabling a local attacker to read local files via dbus-send commands. Affected: Chrome OS builds prior to 59.0.3071.92. Impact is local inform...

CVE-2017-5084: Improper Privilege Management

Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a BurnImage D-Bus endpoint...

CVE-2014-8156

The D-Bus security policy files in /etc/dbus-1/system.d/.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged git master on 2015-01-19,...

CVE-2014-8156: Undefined Security Weakness

The D-Bus security policy files in /etc/dbus-1/system.d/.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged git master on 2015-01-19,...

MGASA-2017-0310 Updated dbus packages fix security vulnerabilities

A format string vulnerability in the reference bus implementation, dbus-daemon, could potentially allow local users to cause arbitrary code execution or denial of service. Symlink attack in nonce-tcp transport bsc1025950. Symlink attack in unit tests bsc1025951...

Updated dbus packages fix security vulnerabilities

A format string vulnerability in the reference bus implementation, dbus-daemon, could potentially allow local users to cause arbitrary code execution or denial of service. Symlink attack in nonce-tcp transport bsc1025950. Symlink attack in unit tests bsc1025951...

PT-2017-19438

Name of the Vulnerable Software and Affected Versions dbus-daemon affected versions not specified Description A format string vulnerability in the reference bus implementation could potentially allow local users to cause arbitrary code execution or denial of service. Additionally, there are symli...

MGASA-2017-0218 Updated cinnamon-settings-daemon packages fix security vulnerability

It was found that csd-datetime-setting SetDate DBUS function does not check the polkit authorization for the caller, Unlike SetTime...

PT-2017-19431

Name of the Vulnerable Software and Affected Versions csd-datetime-setting affected versions not specified Description The issue is related to the SetDate DBUS function in csd-datetime-setting, which does not check for polkit authorization of the caller, unlike the SetTime function. Recommendatio...

Information disclosure

The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to...

CVE-2015-1323

CVE-2015-1323 affects aptdaemon's simulate dbus method, enabling a local attacker to obtain sensitive information or access files with root permissions. Ubuntu packages were affected across multiple releases (12.04 LTS through 15.04) prior to fixed versions (e.g., 1.1.1+bzr982-0ubuntu32.1 and rel...

CVE-2015-1323

The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to...

CVE-2015-1323: Exposure of Sensitive Information to an Unauthorized Actor

The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to...

SUSE SLED12 / SLES12 Security Update : kdelibs4 (SUSE-SU-2017:1335-1)

This update for kdelibs4 fixes the following issues : - CVE-2017-8422: This update fixes problem in the DBUS authentication of the kauth framework that could be used to escalate privileges depending on bugs or misimplemented dbus services. boo1036244 Note that Tenable Network Security has extract...

openSUSE Security Update : smb4k (openSUSE-2017-595)

This update for smb4k fixes the following issues : - Disabled dbus service and polkit rules, because this version of smb4k has a local root exploit issue boo1036245, CVE-2017-8849. Automatic mounting will no longer be possible to work around this security issue. %NASLMINLEVEL 70300 C Tenable...

SUSE-SU-2017:1335-1 Security update for kdelibs4

This update for kdelibs4 fixes the following issues: - CVE-2017-8422: This update fixes problem in the DBUS authentication of the kauth framework that could be used to escalate privileges depending on bugs or misimplemented dbus services. boo1036244...

KDE 4/5 - 'KAuth' Local Privilege Escalation

// cc -Wall smb0k.c -pedantic -std=c11 // // smb4k PoC, also demonstrating broader scope of a generic kde // authentication bypass vulnerability // // C 2017 Sebastian Krahmer // define POSIXCSOURCE 200112L include include include include include include include include include void dieconst char...