CVE-2022-42012 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash...
MediumCVSS 6.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dbus(Debian:12) | < 1.14.4-1 | 1.14.4-1 |
| debian/dbus(Debian:13) | < 1.14.4-1 | 1.14.4-1 |
| debian/dbus(Debian:14) | < 1.14.4-1 | 1.14.4-1 |
| ubuntu/dbus(Ubuntu:22.04) | < 1.12.20-2ubuntu4.1 | 1.12.20-2ubuntu4.1 |
| freedesktop dbus | < 1.12.24 | 1.12.24 |
| freedesktop dbus | >= 1.13.0, < 1.14.4 | 1.14.4 |
| freedesktop dbus | >= 1.15.0, < 1.15.2 | 1.15.2 |
| fedoraproject fedora | = 35 | No fix listed |
| fedoraproject fedora | = 36 | No fix listed |
| fedoraproject fedora | = 37 | No fix listed |
| alpine/dbus(Alpine:v3.13) | >= 1.13.0, < 1.12.24-r0 | 1.12.24-r0 |
| alpine/dbus(Alpine:v3.14) | >= 1.13.0, < 1.12.24-r0 | 1.12.24-r0 |
| alpine/dbus(Alpine:v3.15) | >= 1.13.0, < 1.12.24-r0 | 1.12.24-r0 |
| alpine/dbus(Alpine:v3.16) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.17) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.18) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.19) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.20) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.21) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.22) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.23) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
| alpine/dbus(Alpine:v3.24) | >= 1.13.0, < 1.14.4-r0 | 1.14.4-r0 |
References
- Debian Security Tracker CVE-2022-42012 vendor-advisory
- gitlab.freedesktop.org exploit issue-tracking patch third-party-advisory
- www.openwall.com mailing-list patch third-party-advisory
- FEDORA-2022-076544c8aa mailing-list vendor-advisory
- FEDORA-2022-7a963a79d1 mailing-list vendor-advisory
- FEDORA-2022-b0c2f2ab74 mailing-list vendor-advisory
- GLSA-202305-08 third-party-advisory vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-5704-1 vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory