[ GLSA 202012-17 ] D-Bus

[GLSA]

Gentoo Linux Security Advisory

Title: D-Bus: Denial of service (GLSA 202012-17)
Severity: low
Exploitable: local
Date: 2020-12-23
Bug(s): #755392
ID: 202012-17

Synopsis

A local Denial of Service vulnerability was discovered in D-Bus.

Background

D-Bus is a message bus system which processes can use to talk to each
other.


Affected Packages

Package: sys-apps/dbus
Vulnerable: < 1.12.20
Unaffected: >= 1.12.20
Architectures: All supported architectures


Description

It was discovered that D-Bus did not properly handle the situation when
two usernames have the same numeric UID.


Impact

An attacker could possibly cause a Denial of Service condition or
trigger other undefined behavior, possibly including incorrect
authorization decisions.


Workaround

There is no known workaround at this time.

Resolution

All D-Bus users should upgrade to the latest version: