CVE-2013-2168

The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4...

1.9 LowFix available

The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.

Exploit likelihood

0.38%Down 1.2 points since Feb 4, 2022

What each source reports

NVD Score used 1.9

Record: CVE-2013-2168
CVSS 2.0: 1.9 LowAV:L/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-2168
Updated: 2026-11-02

EUVDEUVD-2013-2128 No score

Record: EUVD-2013-2128
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c26p-366m-4xv6 No score

The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4...

Record: GHSA-c26p-366m-4xv6
Weakness: CWE-20
Updated: 2026-11-02

OSV No score

Record: CVE-2013-2168
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2168 No score

Record: DEBIAN-CVE-2013-2168
Updated: 2026-11-02

OSVMGASA-2013-0173 No score

Updated dbus packages fix security vulnerability

Alexandru Cornea discovered a vulnerability in libdbus caused by an implementation bug in _dbus_printf_string_upper_bound(). This vulnerability can be exploited by a local user to crash system services that use libdbus, causing denial of service. Depending on the dbus services running, it could lead to complete system crash (CVE-2013-2168).

This problem only currently appears to affect the x86_64 version of Mageia but we advise that all systems should be updated.

Record: MGASA-2013-0173
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10517-1 No score

dbus-1-1.10.12-2.1 on GA media

These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10517-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`dbus` Debian:12	before 1.6.12-1	1.6.12-1
`dbus` Debian:13	before 1.6.12-1	1.6.12-1
`dbus` Debian:14	before 1.6.12-1	1.6.12-1
`dbus` Debian:7	before 1.6.8-1+deb7u1, plus listed versions 1.6.8-1	1.6.8-1+deb7u1
`dbus` Mageia:2	before 1.4.16-5.2.mga2	1.4.16-5.2.mga2
`dbus` Mageia:3	before 1.6.8-4.1.mga3	1.6.8-4.1.mga3
`dbus-1` openSUSE:Tumbleweed From an advisory covering 14 CVEs	before 1.10.12-2.1	1.10.12-2.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2168 is a low vulnerability (CVSS 1.9) in Freedesktop Dbus, published June 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in dbus 1.6.12-1.

References

Show 29 moreShow less