Description
A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | D-Bus Development branch | <= 1.13.16 (Fixed: >= 1.13.18) | — |
| — | dbus-1.12.x stable branch | <= 1.12.18 (Fixed: >= 1.12.20) | — |
| — | dbus-1.10.x and older branches (EOL) | <= 1.10.30 (Fixed: 1.10.32) | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dbus | 1.12.20-1 | — |
| Debian 13 | dbus | 1.12.20-1 | — |
| Debian 12 | dbus | 1.12.20-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | dbus | 1.12.16-2ubuntu2.2 | USN-5244-2 |
| Ubuntu 18.04 LTS | dbus | 1.12.2-1ubuntu1.3 | USN-5244-2 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dbus | 1.10.6-1ubuntu3.6+esm1 | USN-5244-1 |
| Ubuntu Pro 14.04 LTS | dbus | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SLES 15 SP2 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SLES 15 SP1 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SLES 15 | dbus-1 +1 | 1.12.2-3.11.1 | SUSE-SU-2021:2211-1 |
| SLES 12 SP5 | dbus-1 +1 | 1.8.22-35.2 | SUSE-SU-2021:2424-1 |
Show 20 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SLES 12 SP3 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SLES 12 SP2 | dbus-1 +1 | 1.8.22-24.22.1 | SUSE-SU-2022:2788-1 |
| SLES for SAP 15 SP1 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SLES for SAP 15 | dbus-1 +1 | 1.12.2-3.11.1 | SUSE-SU-2021:2211-1 |
| SLES for SAP 12 SP5 | dbus-1 +1 | 1.8.22-35.2 | SUSE-SU-2021:2424-1 |
| SLES for SAP 12 SP4 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SLES for SAP 12 SP3 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SLE Micro 5.0 | dbus-1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SLE HPC 15 SP1 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SLE HPC 15 | dbus-1 +1 | 1.12.2-3.11.1 | SUSE-SU-2021:2211-1 |
| SUSE OpenStack Cloud Crowbar 9 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SUSE OpenStack Cloud Crowbar 8 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SUSE OpenStack Cloud 9 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SUSE OpenStack Cloud 8 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SUSE Manager Server 4.0 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SUSE Manager Retail Branch Server 4.0 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SUSE Manager Proxy 4.0 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
| SUSE HPE Helion OpenStack 8 | dbus-1 +1 | 1.8.22-29.21.1 | SUSE-SU-2021:2590-1 |
| SUSE Enterprise Storage 6 | dbus-1 +1 | 1.12.2-8.6.1 | SUSE-SU-2021:2292-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | dbus-1 +1 | 1.12.2-8.6.1 | openSUSE-SU-2021:2292-1 |
| openSUSE Leap 15.2 | dbus-1 +1 | 1.12.2-lp152.6.3.1 | openSUSE-SU-2021:1056-1 |
Advisories 9
- USN-5244-1 dbus vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5244-2 dbus vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2021:2292-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2424-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2590-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2211-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2292-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2788-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1056-1 Security update for dbus-1 SUSE / openSUSE Security Updates · Feb 4, 2026