Fluid Attacks Database

Description

The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	dbus-glib	>=0 <0.100.1-1	0.100.1-1
debian 14	dbus-glib	>=0 <0.100.1-1	0.100.1-1
debian 13	dbus-glib	>=0 <0.100.1-1	0.100.1-1
debian 12	dbus-glib	>=0 <0.100.1-1	0.100.1-1
rpm rhel5	dbus-glib	<0:0.73-11.el5_9	0:0.73-11.el5_9
rpm rhel6	dbus-glib	<0:0.86-6.el6_4	0:0.86-6.el6_4

Aliases

1. CVE-2013-02922. NVD-2013-02923. OSV-DEBIAN-2013-02924. OSV-2013-02925. SECURITY-TRACKER-CVE-2013-0292

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.