Security update for dbus-1, dbus-1-x11 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2015:0300-1 Final 1 1 2015-02-10T09:21:06Z current 2015-02-10T09:21:06Z 2015-02-10T09:21:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dbus-1, dbus-1-x11 dbus-1, dbus-1-x11 were updated to version 1.8.16 to fix one security issue. This update fixes the following security issue: - CVE-2015-0245: Do not allow non-uid-0 processes to send forged ActivationFailure messages. On Linux systems with systemd activation, this would allow a local denial of service (bnc#916343). These additional security hardenings are included: - Do not allow calls to UpdateActivationEnvironment from uids other than the uid of the dbus-daemon. If a system service installs unsafe security policy rules that allow arbitrary method calls (such as CVE-2014-8148) then this prevents memory consumption and possible privilege escalation via UpdateActivationEnvironment. - Do not allow calls to UpdateActivationEnvironment or the Stats interface on object paths other than /org/freedesktop/DBus. Some system services install unsafe security policy rules that allow arbitrary method calls to any destination, method and interface with a specified object path. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html E-Mail link for openSUSE-SU-2015:0300-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings dbus-1-1.8.16-4.36.2 dbus-1-devel-1.8.16-4.36.1 dbus-1-devel-32bit-1.8.16-4.36.1 dbus-1-devel-doc-1.8.16-4.36.2 dbus-1-x11-1.8.16-4.36.2 libdbus-1-3-1.8.16-4.36.1 libdbus-1-3-32bit-1.8.16-4.36.1 D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. CVE-2015-0245 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html https://www.suse.com/security/cve/CVE-2015-0245.html CVE-2015-0245 https://bugzilla.suse.com/1003898 SUSE Bug 1003898 https://bugzilla.suse.com/916343 SUSE Bug 916343