CVE-2008-0595
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes...
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Exploit likelihood
What each source reports
NVD Score used
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
- Record
CVE-2008-0595- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
- Record
CVE-2008-0595- Updated
- 2026-11-02
EUVDEUVD-2008-0605 No score
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
- Record
EUVD-2008-0605- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2x7-p32r-g3vj No score
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes...
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
- Record
GHSA-r2x7-p32r-g3vj- Weakness
- CWE-863
- Updated
- 2026-11-02
OSV No score
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
- Record
CVE-2008-0595- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-0595 No score
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
- Record
DEBIAN-CVE-2008-0595- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10711-1 No score
dbus-1-1.12.20-5.5 on GA media
These are all security issues fixed in the dbus-1-1.12.20-5.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10711-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbusDebian:12 |
before 1.1.20-1 | 1.1.20-1 |
dbusDebian:13 |
before 1.1.20-1 | 1.1.20-1 |
dbusDebian:14 |
before 1.1.20-1 | 1.1.20-1 |
dbusDebian:4.0 |
before 1.0.2-1+etch1, plus listed versions 1.0.2-1 |
1.0.2-1+etch1 |
dbusRed Hat:enterprise_linux:5::client_workstation |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-develRed Hat:enterprise_linux:5::client_workstation |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbusRed Hat:enterprise_linux:5::client |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-x11Red Hat:enterprise_linux:5::client |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dbusRed Hat:enterprise_linux:5::server |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-develRed Hat:enterprise_linux:5::server |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-x11Red Hat:enterprise_linux:5::server |
before 0:1.0.0-6.3.el5_1 | 0:1.0.0-6.3.el5_1 |
dbus-1openSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.12.20-5.5 | 1.12.20-5.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-0595 is a medium vulnerability (CVSS 4.6) in Freedesktop Dbus, published February 29, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in dbus 1.1.20-1.
References
secunia.com/advisories/29281
vupen.com/english/advisories/2008/0694
redhat.com/support/errata/RHSA-2008-0159.html
lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
lists.freedesktop.org/archives/dbus/2008-February/009401.html
Show 35 moreShow less
j5live.com/2008/02/27/announce-d-bus-1120-conisten-water-released
mandriva.com/security/advisories?name=MDVSA-2008:054
securityfocus.com/archive/1/489280/100/0/threaded
wiki.rpath.com/wiki/Advisories:rPSA-2008-0099
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9353
securitytracker.com/id?1019512
debian.org/security/2008/dsa-1599
issues.rpath.com/browse/RPL-2282
ubuntu.com/usn/usn-653-1
nvd.nist.gov/vuln/detail/CVE-2008-0595
github.com/advisories/GHSA-r2x7-p32r-g3vj
security-tracker.debian.org/tracker/CVE-2008-0595
access.redhat.com/errata/RHSA-2008:0159
bugzilla.redhat.com/show_bug.cgi?id=432419
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0159.json
cve.org/CVERecord?id=CVE-2008-0595
suse.com/security/cve/CVE-2006-6107