Description
Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dbus | 1.0.2-1 | — |
| Debian 13 | dbus | 1.0.2-1 | — |
| Debian 12 | dbus | 1.0.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | dbus +4 | 0.22-12.EL.8 | RHSA-2007:0008 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dbus-1 | 1.12.20-5.5 | openSUSE-SU-2024:10711-1 |
Advisories 2
- RHSA-2007:0008 Red Hat Security Advisory: dbus security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10711-1 dbus-1-1.12.20-5.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 23611 third-party-advisory
- https://bugs.freedesktop.org/show_bug.cgi?id=9142
- openSUSE-SU-2012:1418 vendor-advisory
- 24131 third-party-advisory
- [security-announce] 20070209 rPSA-2006-0233-1 dbus dbus-glib dbus-qt dbus-x11 mailing-list
- dbus-matchruleequal-dos(30874) vdb-entry
- RHSA-2007:0008 vendor-advisory
- MDKSA-2006:233 vendor-advisory
- 23373 third-party-advisory
- 24059 third-party-advisory
- oval:org.mitre.oval:def:9951 vdb-entry signature
- https://issues.rpath.com/browse/RPL-860
- 23390 third-party-advisory
- http://www.freedesktop.org/wiki/Software/dbus
- USN-401-1 vendor-advisory
- OpenPKG-SA-2006.041 vendor-advisory
- 1017608 vdb-entry
- 21571 vdb-entry
- ADV-2006-4988 vdb-entry