UBUNTU-CVE-2026-120749

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-120749
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-120749
Upstream
  • CVE-2026-120749
Published
2026-11-06T00:00:00Z
Modified
2026-11-07T01:46:13Z
Severity
  • 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.

References

Affected packages

Ubuntu:18.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.22-1ubuntu1
1.12.0-1ubuntu1
1.12.2-1ubuntu1
1.12.2-1ubuntu1.1
1.12.2-1ubuntu1.2
1.12.2-1ubuntu1.3
1.12.2-1ubuntu1.4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.12.2-1ubuntu1.4"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.12.2-1ubuntu1.4"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.12.2-1ubuntu1.4"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.12.2-1ubuntu1.4"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.12.2-1ubuntu1.4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:20.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.12.14-1ubuntu2
1.12.16-2ubuntu1
1.12.16-2ubuntu2
1.12.16-2ubuntu2.1
1.12.16-2ubuntu2.2
1.12.16-2ubuntu2.3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.12.16-2ubuntu2.3"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.12.16-2ubuntu2.3"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.12.16-2ubuntu2.3"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.12.16-2ubuntu2.3"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.12.16-2ubuntu2.3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:22.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.12.20-2ubuntu2
1.12.20-2ubuntu3
1.12.20-2ubuntu4
1.12.20-2ubuntu4.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.12.20-2ubuntu4.1"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.12.20-2ubuntu4.1"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.12.20-2ubuntu4.1"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.12.20-2ubuntu4.1"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.12.20-2ubuntu4.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:24.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.14.10-1ubuntu1
1.14.10-3ubuntu1
1.14.10-4ubuntu1
1.14.10-4ubuntu2
1.14.10-4ubuntu3
1.14.10-4ubuntu4
1.14.10-4ubuntu4.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-bin",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-daemon",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-session-bus-common",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-system-bus-common",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.14.10-4ubuntu4.1"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.14.10-4ubuntu4.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:26.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.16.2-2ubuntu2
1.16.2-2ubuntu3
1.16.2-2ubuntu4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-bin",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-daemon",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-session-bus-common",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-system-bus-common",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.16.2-2ubuntu4"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.16.2-2ubuntu4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:26.10
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.16.2-2ubuntu4
1.16.2-5ubuntu1
1.16.2-5ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-bin",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-daemon",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-session-bus-common",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-system-bus-common",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.16.2-5ubuntu2"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.16.2-5ubuntu2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:Pro:14.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.12-0ubuntu10
1.6.18-0ubuntu1
1.6.18-0ubuntu2
1.6.18-0ubuntu3
1.6.18-0ubuntu4
1.6.18-0ubuntu4.1
1.6.18-0ubuntu4.2
1.6.18-0ubuntu4.3
1.6.18-0ubuntu4.4
1.6.18-0ubuntu4.5
1.6.18-0ubuntu4.5+esm1
1.6.18-0ubuntu4.5+esm2
1.6.18-0ubuntu4.5+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.6.18-0ubuntu4.5+esm3"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.6.18-0ubuntu4.5+esm3"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.6.18-0ubuntu4.5+esm3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"
Ubuntu:Pro:16.04:LTS
dbus

Package

Name
dbus
Purl
pkg:deb/ubuntu/dbus?arch=source&distro=esm-infra%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.0-1ubuntu1
1.10.4-1ubuntu2
1.10.6-1ubuntu1
1.10.6-1ubuntu2
1.10.6-1ubuntu3
1.10.6-1ubuntu3.1
1.10.6-1ubuntu3.3
1.10.6-1ubuntu3.4
1.10.6-1ubuntu3.5
1.10.6-1ubuntu3.6
1.10.6-1ubuntu3.6+esm1
1.10.6-1ubuntu3.6+esm2
1.10.6-1ubuntu3.6+esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dbus",
            "binary_version": "1.10.6-1ubuntu3.6+esm3"
        },
        {
            "binary_name": "dbus-tests",
            "binary_version": "1.10.6-1ubuntu3.6+esm3"
        },
        {
            "binary_name": "dbus-user-session",
            "binary_version": "1.10.6-1ubuntu3.6+esm3"
        },
        {
            "binary_name": "dbus-x11",
            "binary_version": "1.10.6-1ubuntu3.6+esm3"
        },
        {
            "binary_name": "libdbus-1-3",
            "binary_version": "1.10.6-1ubuntu3.6+esm3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-120749.json"