CVEvulnerability

CVE-2020-12049

5.5 MEDIUM Published 2020-06-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-06-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.9 MEDIUM — AV:L/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-404

Description

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

Affected configurations

• freedesktop dbus (>= 1.3.0 < 1.12.18) • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.10 • canonical ubuntu linux 20.04

Related

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References