Univention Bugzilla – Bug 55272
dbus: Multiple issues (5.0)
Last modified: 2022-10-20 13:41:18 CEST
New Debian dbus 1.12.24-0+deb10u1 fixes: This update addresses the following issues: * An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. (CVE-2022-42010) * An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. (CVE-2022-42011) * An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)
--- mirror/ftp/pool/main/d/dbus/dbus_1.12.20-0+deb10u1.dsc +++ apt/ucs_5.0-0-errata5.0-2/source/dbus_1.12.24-0+deb10u1.dsc @@ -1,3 +1,14 @@ +1.12.24-0+deb10u1 [Mon, 10 Oct 2022 13:19:03 +0200] Emilio Pozuelo Monfort <pochu@debian.org>: + + * Non-maintainer upload by the LTS Team. + * New upstream stable release. Notable changes: + - Fix several denial of service issues where an authenticated attacker + can crash the system bus by sending crafted messages + (CVE-2022-42010, CVE-2022-42011, CVE-2022-42012) + - Use a path-based Unix socket for the session bus, avoiding sandbox + escape for Flatpak apps with network access (dbus#416) + - Don't crash if asked to watch more than 128 directories for changes + 1.12.20-0+deb10u1 [Sun, 05 Jul 2020 17:10:45 +0100] Simon McVittie <smcv@debian.org>: * New upstream stable release <http://piuparts.knut.univention.de/5.0-2/#8990607768901602024>
OK: yaml OK: announce_errata OK: patch OK: piuparts [5.0-2] 374142e8a6 Bug #55272: dbus 1.12.24-0+deb10u1 doc/errata/staging/dbus.yaml | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) [5.0-2] b9f303c65a Bug #55272: dbus 1.12.24-0+deb10u1 doc/errata/staging/dbus.yaml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.0x461>