DEBIAN-CVE-2026-120749
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-120749
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120749.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-120749
- Upstream
- CVE-2026-120749
- Published
- 2026-11-06T07:17:06Z
- Modified
- 2026-11-07T23:00:06Z
- Severity
-
- 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.
- References
Affected packages
Debian:12 / dbus
Package
- Name
- dbus
- Purl
- pkg:deb/debian/dbus?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.14.6-1
1.14.8-1~deb12u1
1.14.8-1
1.14.8-1+loong64
1.14.8-2~deb12u1
1.14.8-2
1.14.10-1~deb12u1
1.14.10-1
1.14.10-2
1.14.10-3
1.14.10-4
1.14.10-5
1.14.10-6
1.14.99~git20220715-1
1.15.0-1
1.15.2-1
1.15.4-1
1.15.6-1
1.15.6-2
1.15.8-1
1.15.8-2
1.15.8-3
1.15.8-4
1.15.10-1
1.15.12-1
1.15.90-1
1.15.92-1
1.16.0-1
1.16.2-1
1.16.2-2
1.16.2-3
1.16.2-4
1.16.2-5
1.16.2-6
1.16.2-7
1.16.2-8
Debian:13 / dbus
Package
- Name
- dbus
- Purl
- pkg:deb/debian/dbus?arch=source&distro=trixie
Debian:14 / dbus
Package
- Name
- dbus
- Purl
- pkg:deb/debian/dbus?arch=source&distro=forky