CVE-2014-3532
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later,...
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
Exploit likelihood
What each source reports
NVD Score used
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
CVE-2014-3532- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
CVE-2014-3532- Updated
- 2026-11-02
EUVDEUVD-2014-3527 No score
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
EUVD-2014-3527- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7x26-2rv5-r99f No score
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later,...
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
GHSA-7x26-2rv5-r99f- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
CVE-2014-3532- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3532 No score
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
DEBIAN-CVE-2014-3532- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0294 No score
Updated dbus packages fix multiple vulnerabilities
Updated dbus packages fix security vulnerabilities:
A flaw was reported in D-Bus's file descriptor passing feature. A local attacker could use this flaw to cause a service or application to disconnect from the bus, typically resulting in that service or application exiting (CVE-2014-3532).
A flaw was reported in D-Bus's file descriptor passing feature. A local attacker could use this flaw to cause an invalid file descriptor to be forwarded to a service or application, causing it to disconnect from the bus, typically resulting in that service or application exiting (CVE-2014-3533).
- Record
MGASA-2014-0294- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10517-1 No score
dbus-1-1.10.12-2.1 on GA media
These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10517-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3532 No score
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.
- Record
UBUNTU-CVE-2014-3532- Updated
- 2026-11-02
OSVUSN-2275-1 No score
dbus vulnerabilities
Alban Crequy discovered that dbus-daemon incorrectly sent AccessDenied errors to the service instead of the client when enforcing permissions. A local user can use this issue to possibly deny access to the service. (CVE-2014-3477)
Alban Crequy discovered that dbus-daemon incorrectly handled certain file descriptors. A local attacker could use this issue to cause services or clients to disconnect, resulting in a denial of service. (CVE-2014-3532, CVE-2014-3533)
- Record
USN-2275-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbusDebian:12 |
before 1.8.6-1 | 1.8.6-1 |
dbusDebian:13 |
before 1.8.6-1 | 1.8.6-1 |
dbusDebian:14 |
before 1.8.6-1 | 1.8.6-1 |
dbusDebian:7 |
before 1.6.8-1+deb7u3, plus listed versions 1.6.8-11.6.8-1+deb7u11.6.8-1+deb7u2 |
1.6.8-1+deb7u3 |
dbusMageia:3 |
before 1.6.8-4.4.mga3 | 1.6.8-4.4.mga3 |
dbusMageia:4 |
before 1.6.18-1.3.mga4 | 1.6.18-1.3.mga4 |
dbusUbuntu:14.04:LTS |
before 1.6.18-0ubuntu4.1, plus listed versions 1.6.12-0ubuntu101.6.18-0ubuntu11.6.18-0ubuntu21.6.18-0ubuntu31.6.18-0ubuntu4 |
1.6.18-0ubuntu4.1 |
dbus-1openSUSE:Tumbleweed |
before 1.10.12-2.1 | 1.10.12-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3532 is a low vulnerability (CVSS 2.1) in Debian Linux, published July 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in dbus 1.8.6-1.
References
secunia.com/advisories/59798
lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
advisories.mageia.org/MGASA-2014-0294.html
bugs.freedesktop.org/show_bug.cgi?id=80163
Show 29 moreShow less
oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
debian.org/security/2014/dsa-2971
openwall.com/lists/oss-security/2014/07/02/4
mandriva.com/security/advisories?name=MDVSA-2015:176
nvd.nist.gov/vuln/detail/CVE-2014-3532
github.com/advisories/GHSA-7x26-2rv5-r99f
security-tracker.debian.org/tracker/CVE-2014-3532
lists.freedesktop.org/archives/dbus/2014-July/016235.html
lists.fedoraproject.org/pipermail/package-announce/2014-July/135226.html
bugs.mageia.org/show_bug.cgi?id=13653
ubuntu.com/security/CVE-2014-3532
cve.org/CVERecord?id=CVE-2014-3532
suse.com/security/cve/CVE-2010-4352