CVE-2015-0245

Publication date 13 February 2015

Last updated 24 July 2024

Ubuntu priority

D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
dbus	17.04 zesty	Not affected
	16.10 yakkety	Not affected
	16.04 LTS xenial	Not affected
	15.10 wily	Not affected
	15.04 vivid	Ignored end of life
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Fixed 1.6.18-0ubuntu4.4
	12.04 LTS precise	Fixed 1.4.18-1ubuntu1.8
	10.04 LTS lucid	Not affected

Notes

seth-arnold

The policy change is recommended for stable use, though the code-based changes were made for platforms where uid==0 may not be omnipotent -- we should probably use both in our packages, or at least both for the versions with distro-patched AppArmor support.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
dbus	Upstream: ?id=6db Upstream: ?id=aae Upstream: ?id=03c Upstream: ?h=dbus Upstream: ?h=dbus

References

Related Ubuntu Security Notices (USN)