CVE-2014-7824
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local...
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
Exploit likelihood
What each source reports
NVD Score used
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
CVE-2014-7824- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
CVE-2014-7824- Updated
- 2026-11-02
EUVDEUVD-2014-7690 No score
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
EUVD-2014-7690- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2vxr-xm37-7x29 No score
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local...
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
GHSA-2vxr-xm37-7x29- Updated
- 2026-11-02
OSV No score
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
CVE-2014-7824- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-7824 No score
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
DEBIAN-CVE-2014-7824- Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2014-0457 No score
Updated dbus packages fix security vulnerabilitiy
The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as "CVE-2014-3636 part A", which is repeated below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value.
By queuing up the maximum allowed number of fds, a malicious sender could reach the system dbus-daemon's RLIMIT_NOFILE (ulimit -n, typically 1024 on Linux). This would act as a denial of service in two ways:
- new clients would be unable to connect to the dbus-daemon
- when receiving a subsequent message from a non-malicious client that contained a fd, dbus-daemon would receive the MSG_CTRUNC flag, indicating that the list of fds was truncated; kernel fd-passing APIs do not provide any way to recover from that, so dbus-daemon responds to MSG_CTRUNC by disconnecting the sender, causing denial of service to that sender.
This update resolves the issue (CVE-2014-7824).
Also default auth_timeout that was changed from 30s to 5s in MGASA-2014-0395, and raised to 20s in MGAA-2014-0182 is now changed back to 30s as there still are reports about failing dbus connections.
- Record
MGASA-2014-0457- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10517-1 No score
dbus-1-1.10.12-2.1 on GA media
These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10517-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2699-1 No score
Security update for SLES 12 Docker image
The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.
The following issues related to building of the container images have been fixed:
- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
- Do not install recommended packages when building container images. (bsc#975726)
A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.
pam:
- CVE-2015-3238
libtasn1:
- CVE-2015-3622
- CVE-2016-4008
libidn:
- CVE-2015-2059
- CVE-2015-8948
- CVE-2016-6261
- CVE-2016-6262
- CVE-2016-6263
zlib:
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
curl:
- CVE-2016-5419
- CVE-2016-5420
- CVE-2016-5421
- CVE-2016-7141
- CVE-2016-7167
- CVE-2016-8615
- CVE-2016-8616
- CVE-2016-8617
- CVE-2016-8618
- CVE-2016-8619
- CVE-2016-8620
- CVE-2016-8621
- CVE-2016-8622
- CVE-2016-8623
- CVE-2016-8624
- CVE-2016-9586
- CVE-2017-1000100
- CVE-2017-1000101
- CVE-2017-7407
openssl:
- CVE-2016-2105
- CVE-2016-2106
- CVE-2016-2107
- CVE-2016-2108
- CVE-2016-2109
- CVE-2016-2177
- CVE-2016-2178
- CVE-2016-2179
- CVE-2016-2180
- CVE-2016-2181
- CVE-2016-2182
- CVE-2016-2183
- CVE-2016-6302
- CVE-2016-6303
- CVE-2016-6304
- CVE-2016-6306
libxml2:
- CVE-2014-0191
- CVE-2015-8806
- CVE-2016-1762
- CVE-2016-1833
- CVE-2016-1834
- CVE-2016-1835
- CVE-2016-1837
- CVE-2016-1838
- CVE-2016-1839
- CVE-2016-1840
- CVE-2016-2073
- CVE-2016-3627
- CVE-2016-3705
- CVE-2016-4447
- CVE-2016-4448
- CVE-2016-4449
- CVE-2016-4483
- CVE-2016-4658
- CVE-2016-9318
- CVE-2016-9597
- CVE-2017-9047
- CVE-2017-9048
- CVE-2017-9049
- CVE-2017-9050
util-linux:
- CVE-2015-5218
- CVE-2016-5011
- CVE-2017-2616
cracklib:
- CVE-2016-6318
systemd:
- CVE-2014-9770
- CVE-2015-8842
- CVE-2016-7796
pcre:
- CVE-2014-8964
- CVE-2015-2325
- CVE-2015-2327
- CVE-2015-2328
- CVE-2015-3210
- CVE-2015-3217
- CVE-2015-5073
- CVE-2015-8380
- CVE-2015-8381
- CVE-2015-8382
- CVE-2015-8383
- CVE-2015-8384
- CVE-2015-8385
- CVE-2015-8386
- CVE-2015-8387
- CVE-2015-8388
- CVE-2015-8389
- CVE-2015-8390
- CVE-2015-8391
- CVE-2015-8392
- CVE-2015-8393
- CVE-2015-8394
- CVE-2015-8395
- CVE-2016-1283
- CVE-2016-3191
appamor:
- CVE-2017-6507
bash:
- CVE-2014-6277
- CVE-2014-6278
- CVE-2016-0634
- CVE-2016-7543
cpio:
- CVE-2016-2037
glibc:
- CVE-2016-1234
- CVE-2016-3075
- CVE-2016-3706
- CVE-2016-4429
- CVE-2017-1000366
perl:
- CVE-2015-8853
- CVE-2016-1238
- CVE-2016-2381
- CVE-2016-6185
libssh2_org:
- CVE-2016-0787
expat:
- CVE-2012-6702
- CVE-2015-1283
- CVE-2016-0718
- CVE-2016-5300
- CVE-2016-9063
- CVE-2017-9233
ncurses:
- CVE-2017-10684
- CVE-2017-10685
- CVE-2017-11112
- CVE-2017-11113
libksba:
- CVE-2016-4574
- CVE-2016-4579
libgcrypt:
- CVE-2015-7511
- CVE-2016-6313
- CVE-2017-7526
dbus-1:
- CVE-2014-7824
- CVE-2015-0245
Finally, the following packages received non-security fixes:
- augeas
- bzip2
- ca-certificates-mozilla
- coreutils
- cryptsetup
- cyrus-sasl
- dirmngr
- e2fsprogs
- findutils
- gpg2
- insserv-compat
- kmod
- libcap
- libsolv
- libzypp
- openldap2
- p11-kit
- permissions
- procps
- rpm
- sed
- shadow
- zypper
- Record
SUSE-SU-2017:2699-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2700-1 No score
Security update for SLES 12-SP1 Docker image
The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.
The following issues related to building of the container images have been fixed:
- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
- Do not install recommended packages when building container images. (bsc#975726)
A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.
pam:
- CVE-2015-3238
libtasn1:
- CVE-2015-3622
- CVE-2016-4008
expat:
expat:
- CVE-2012-6702
- CVE-2015-1283
- CVE-2016-0718
- CVE-2016-5300
- CVE-2016-9063
- CVE-2017-9233
libidn:
- CVE-2015-2059
- CVE-2015-8948
- CVE-2016-6261
- CVE-2016-6262
- CVE-2016-6263
zlib:
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
curl:
- CVE-2016-5419
- CVE-2016-5420
- CVE-2016-5421
- CVE-2016-7141
- CVE-2016-7167
- CVE-2016-8615
- CVE-2016-8616
- CVE-2016-8617
- CVE-2016-8618
- CVE-2016-8619
- CVE-2016-8620
- CVE-2016-8621
- CVE-2016-8622
- CVE-2016-8623
- CVE-2016-8624
- CVE-2016-9586
- CVE-2017-1000100
- CVE-2017-1000101
- CVE-2017-7407
openssl:
- CVE-2016-2105
- CVE-2016-2106
- CVE-2016-2107
- CVE-2016-2108
- CVE-2016-2109
- CVE-2016-2177
- CVE-2016-2178
- CVE-2016-2179
- CVE-2016-2180
- CVE-2016-2181
- CVE-2016-2182
- CVE-2016-2183
- CVE-2016-6302
- CVE-2016-6303
- CVE-2016-6304
- CVE-2016-6306
- CVE-2016-7056
- CVE-2016-8610
- CVE-2017-3731
cracklib:
- CVE-2016-6318
pcre:
- CVE-2014-8964
- CVE-2015-2325
- CVE-2015-2327
- CVE-2015-2328
- CVE-2015-3210
- CVE-2015-3217
- CVE-2015-5073
- CVE-2015-8380
- CVE-2015-8381
- CVE-2015-8382
- CVE-2015-8383
- CVE-2015-8384
- CVE-2015-8385
- CVE-2015-8386
- CVE-2015-8387
- CVE-2015-8388
- CVE-2015-8389
- CVE-2015-8390
- CVE-2015-8391
- CVE-2015-8392
- CVE-2015-8393
- CVE-2015-8394
- CVE-2015-8395
- CVE-2016-1283
- CVE-2016-3191
appamor:
- CVE-2017-6507
bash:
- CVE-2014-6277
- CVE-2014-6278
- CVE-2016-0634
- CVE-2016-7543
cpio:
- CVE-2016-2037
glibc:
- CVE-2016-1234
- CVE-2016-3075
- CVE-2016-3706
- CVE-2016-4429
- CVE-2017-1000366
perl:
- CVE-2015-8853
- CVE-2016-1238
- CVE-2016-2381
- CVE-2016-6185
libssh2_org:
- CVE-2016-0787
util-linux:
- CVE-2016-5011
- CVE-2017-2616
ncurses:
- CVE-2017-10684
- CVE-2017-10685
- CVE-2017-11112
- CVE-2017-11113
libksba:
- CVE-2016-4574
- CVE-2016-4579
libxml2:
- CVE-2014-0191
- CVE-2015-8806
- CVE-2016-1762
- CVE-2016-1833
- CVE-2016-1834
- CVE-2016-1835
- CVE-2016-1837
- CVE-2016-1838
- CVE-2016-1839
- CVE-2016-1840
- CVE-2016-2073
- CVE-2016-3627
- CVE-2016-3705
- CVE-2016-4447
- CVE-2016-4448
- CVE-2016-4449
- CVE-2016-4483
- CVE-2016-4658
- CVE-2016-9318
- CVE-2016-9597
- CVE-2017-9047
- CVE-2017-9048
- CVE-2017-9049
- CVE-2017-9050
libgcrypt:
- CVE-2015-7511
- CVE-2016-6313
- CVE-2017-7526
update-alternatives:
- CVE-2015-0860
systemd:
- CVE-2014-9770
- CVE-2015-8842
- CVE-2016-7796
dbus-1:
- CVE-2014-7824
- CVE-2015-0245
Finally, the following packages received non-security fixes:
- augeas
- bzip2
- ca-certificates-mozilla
- coreutils
- cryptsetup
- cyrus-sasl
- dirmngr
- e2fsprogs
- findutils
- gpg2
- insserv-compat
- kmod
- libcap
- libsolv
- libzypp
- lua51
- lvm2
- netcfg
- p11-kit
- permissions
- procps
- rpm
- sed
- sg3_utils
- shadow
- zypper
- Record
SUSE-SU-2017:2700-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-7824 No score
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- Record
UBUNTU-CVE-2014-7824- Updated
- 2026-11-02
OSVUSN-2425-1 No score
dbus vulnerability
It was discovered that DBus incorrectly handled a large number of file descriptor messages. A local attacker could use this issue to cause DBus to stop responding, resulting in a denial of service. (CVE-2014-7824)
- Record
USN-2425-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbusDebian:12 |
before 1.8.10-1 | 1.8.10-1 |
dbusDebian:13 |
before 1.8.10-1 | 1.8.10-1 |
dbusDebian:14 |
before 1.8.10-1 | 1.8.10-1 |
dbusDebian:7 |
before 1.6.8-1+deb7u5, plus listed versions 1.6.8-11.6.8-1+deb7u11.6.8-1+deb7u21.6.8-1+deb7u31.6.8-1+deb7u4 |
1.6.8-1+deb7u5 |
dbusMageia:3 |
before 1.6.8-4.8.mga3 | 1.6.8-4.8.mga3 |
dbusMageia:4 |
before 1.6.18-1.8.mga4 | 1.6.18-1.8.mga4 |
dbusUbuntu:14.04:LTS |
before 1.6.18-0ubuntu4.3, plus listed versions 1.6.12-0ubuntu101.6.18-0ubuntu11.6.18-0ubuntu21.6.18-0ubuntu31.6.18-0ubuntu41.6.18-0ubuntu4.11.6.18-0ubuntu4.2 |
1.6.18-0ubuntu4.3 |
dbus-1openSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 1.10.12-2.1 | 1.10.12-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7824 is a low vulnerability (CVSS 2.1) in Canonical Ubuntu Linux, published November 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in dbus 1.8.10-1.
References
openwall.com/lists/oss-security/2014/11/10/2
secunia.com/advisories/62603
advisories.mageia.org/MGASA-2014-0457.html
bugs.freedesktop.org/show_bug.cgi?id=85105
exchange.xforce.ibmcloud.com/vulnerabilities/98576
securityfocus.com/bid/71012
Show 172 moreShow less
ubuntu.com/usn/USN-2425-1
debian.org/security/2014/dsa-3099
mandriva.com/security/advisories?name=MDVSA-2015:176
nvd.nist.gov/vuln/detail/CVE-2014-7824
github.com/advisories/GHSA-2vxr-xm37-7x29
security-tracker.debian.org/tracker/CVE-2014-7824
bugs.mageia.org/show_bug.cgi?id=14494
suse.com/support/update/announcement/2017/suse-su-20172699-1
bugzilla.suse.com/1056193
ubuntu.com/security/CVE-2014-7824
xforce.iss.net/xforce/xfdb/98576
cve.org/CVERecord?id=CVE-2014-7824