[ANNOUNCE] D-Bus 1.4.1 (fixing CVE-2010-4352)
brian.cameron at oracle.com
Mon Dec 20 15:49:32 PST 2010
I assume the CVE-2010-4352 issue does not affect D-Bus 1.2 since no
mention is made. Can you confirm?
On 12/20/10 03:44 PM, Will Thompson wrote:
> A new stable release of D-Bus is now available, fixing a
> denial-of-service issue.
> This release contains a fix for
> <https://bugs.freedesktop.org/show_bug.cgi?id=32321>, originally
> reported on this list by Rémi Denis-Courmont, who has an analysis at
> This bug allows a local user to crash the bus daemon, but not to execute
> arbitrary code, by sending it a specially-crafted message. Once the bus
> daemon has been upgraded, it will reject such messages without relaying
> them; thus, services besides the bus daemon itself do not need to be
More information about the dbus