CVE-2014-3477
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends...
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
Exploit likelihood
What each source reports
CVE List
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
CVE-2014-3477- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
EUVDEUVD-2014-3486
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
EUVD-2014-3486- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qj2p-fqqf-6x63
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends...
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
GHSA-qj2p-fqqf-6x63- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
NVD
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
CVE-2014-3477- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3477
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
DEBIAN-CVE-2014-3477- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3477
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
UBUNTU-CVE-2014-3477- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSV No score
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- Record
CVE-2014-3477- Updated
- 2026-11-02
OSVMGASA-2014-0266 No score
Updated dbus packages fix security vulnerability
Updated dbus packages fix security vulnerability:
A denial of service vulnerability in D-Bus before 1.6.20 allows a local attacker to cause a bus-activated service that is not currently running to attempt to start, and fail, denying other users access to this service Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate (CVE-2014-3477).
- Record
MGASA-2014-0266- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10517-1 No score
dbus-1-1.10.12-2.1 on GA media
These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10517-1- Updated
- 2026-11-02
OSVUSN-2275-1 No score
dbus vulnerabilities
Alban Crequy discovered that dbus-daemon incorrectly sent AccessDenied errors to the service instead of the client when enforcing permissions. A local user can use this issue to possibly deny access to the service. (CVE-2014-3477)
Alban Crequy discovered that dbus-daemon incorrectly handled certain file descriptors. A local attacker could use this issue to cause services or clients to disconnect, resulting in a denial of service. (CVE-2014-3532, CVE-2014-3533)
- Record
USN-2275-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbusDebian:12 |
before 1.8.4-1 | 1.8.4-1 |
dbusDebian:13 |
before 1.8.4-1 | 1.8.4-1 |
dbusDebian:14 |
before 1.8.4-1 | 1.8.4-1 |
dbusDebian:6.0 |
before 1.2.24-4+squeeze3, plus listed versions 1.2.24-41.2.24-4+squeeze11.2.24-4+squeeze2 |
1.2.24-4+squeeze3 |
dbusDebian:7 |
before 1.6.8-1+deb7u3, plus listed versions 1.6.8-11.6.8-1+deb7u11.6.8-1+deb7u2 |
1.6.8-1+deb7u3 |
dbusMageia:3 |
before 1.6.8-4.2.mga3 | 1.6.8-4.2.mga3 |
dbusMageia:4 |
before 1.6.18-1.1.mga4 | 1.6.18-1.1.mga4 |
dbusUbuntu:14.04:LTS |
before 1.6.18-0ubuntu4.1, plus listed versions 1.6.12-0ubuntu101.6.18-0ubuntu11.6.18-0ubuntu21.6.18-0ubuntu31.6.18-0ubuntu4 |
1.6.18-0ubuntu4.1 |
dbus-1openSUSE:Tumbleweed |
before 1.10.12-2.1 | 1.10.12-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3477 is a low vulnerability (CVSS 2.1) in D-bus Project D-bus, published June 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in dbus 1.8.4-1.
References
secunia.com/advisories/59798
lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
securityfocus.com/bid/67986
seclists.org/oss-sec/2014/q2/509
Show 31 moreShow less
advisories.mageia.org/MGASA-2014-0266.html
bugs.freedesktop.org/show_bug.cgi?id=78979
cgit.freedesktop.org/dbus/dbus/commit?h=dbus-1.8&id=24c590703ca47eb71ddef453de43126b90954567
debian.org/security/2014/dsa-2971
mandriva.com/security/advisories?name=MDVSA-2015:176
nvd.nist.gov/vuln/detail/CVE-2014-3477
github.com/advisories/GHSA-qj2p-fqqf-6x63
security-tracker.debian.org/tracker/CVE-2014-3477
bugs.mageia.org/show_bug.cgi?id=13513
lists.freedesktop.org/archives/dbus/2014-June/016220.html
ubuntu.com/security/CVE-2014-3477
cve.org/CVERecord?id=CVE-2014-3477
suse.com/security/cve/CVE-2010-4352