Every CVE Search/ Get API key

CVE-2009-1189

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus)...

3.6 LowFix available

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Exploit likelihood

1.32%Down 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.6

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Record
CVE-2009-1189
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Record
CVE-2009-1189
Updated
2026-11-02
EUVDEUVD-2009-1189 No score

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Record
EUVD-2009-1189
Updated
2026-11-03
GitHub AdvisoriesGHSA-2332-hcww-wjmr No score

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus)...

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Record
GHSA-2332-hcww-wjmr
Weakness
CWE-20
Updated
2026-11-02
OSVBELL-CVE-2009-1189 3.6

CVE-2009-1189 does not affect BellSoft software

Record
BELL-CVE-2009-1189
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Updated
2026-11-02
OSV No score

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Record
CVE-2009-1189
Updated
2026-11-02
OSVDEBIAN-CVE-2009-1189 No score

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Record
DEBIAN-CVE-2009-1189
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dbus
Debian:12
 before 1.2.14-1
1.2.14-1
dbus
Debian:13
 before 1.2.14-1
1.2.14-1
dbus
Debian:14
 before 1.2.14-1
1.2.14-1
dbus
Debian:4.0
 before 1.0.2-1+etch3, plus listed versions
1.0.2-11.0.2-1+etch11.0.2-1+etch2
1.0.2-1+etch3
dbus
Debian:5.0
 before 1.2.1-5+lenny1, plus listed versions
1.2.1-5
1.2.1-5+lenny1
dbus
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus
Red Hat:enterprise_linux:5::client
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
dbus-libs
Red Hat:enterprise_linux:5::client
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-x11
Red Hat:enterprise_linux:5::client
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus
Red Hat:enterprise_linux:5::server
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-devel
Red Hat:enterprise_linux:5::server
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-libs
Red Hat:enterprise_linux:5::server
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1
dbus-x11
Red Hat:enterprise_linux:5::server
 before 0:1.1.2-12.el5_4.1
0:1.1.2-12.el5_4.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1189 is a low vulnerability (CVSS 3.6) in Freedesktop Dbus, published April 27, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in dbus 1.2.14-1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open