CVE-2015-0245
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not...
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Exploit likelihood
What each source reports
NVD Score used
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
CVE-2015-0245- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
CVE-2015-0245- Updated
- 2026-11-02
EUVDEUVD-2015-0267 No score
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
EUVD-2015-0267- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jc2-f36v-gc57 No score
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not...
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
GHSA-8jc2-f36v-gc57- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
CVE-2015-0245- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0245 No score
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
DEBIAN-CVE-2015-0245- Updated
- 2026-11-02
Show 7 moreShow less
OSVMGASA-2015-0071 No score
Updated dbus packages fix security vulnerabilities
non-systemd processes can make dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester, causing a local denial of service (CVE-2015-0245)
- Record
MGASA-2015-0071- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10517-1 No score
dbus-1-1.10.12-2.1 on GA media
These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10517-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0457-1 No score
Security update for dbus-1
dbus-1 was updated to version 1.8.16 to fix one security issue.
This update fixes the following security issue:
- CVE-2015-0245: Do not allow non-uid-0 processes to send forged ActivationFailure messages. On Linux systems with systemd activation, this would allow a local denial of service (bnc#916343).
These additional security hardenings are included:
- Do not allow calls to UpdateActivationEnvironment from uids other than the uid of the dbus-daemon. If a system service installs unsafe security policy rules that allow arbitrary method calls (such as CVE-2014-8148) then this prevents memory consumption and possible privilege escalation via UpdateActivationEnvironment.
- Do not allow calls to UpdateActivationEnvironment or the Stats interface on object paths other than /org/freedesktop/DBus. Some system services install unsafe security policy rules that allow arbitrary method calls to any destination, method and interface with a specified object path.
- Record
SUSE-SU-2015:0457-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2699-1 No score
Security update for SLES 12 Docker image
The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.
The following issues related to building of the container images have been fixed:
- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
- Do not install recommended packages when building container images. (bsc#975726)
A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.
pam:
- CVE-2015-3238
libtasn1:
- CVE-2015-3622
- CVE-2016-4008
libidn:
- CVE-2015-2059
- CVE-2015-8948
- CVE-2016-6261
- CVE-2016-6262
- CVE-2016-6263
zlib:
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
curl:
- CVE-2016-5419
- CVE-2016-5420
- CVE-2016-5421
- CVE-2016-7141
- CVE-2016-7167
- CVE-2016-8615
- CVE-2016-8616
- CVE-2016-8617
- CVE-2016-8618
- CVE-2016-8619
- CVE-2016-8620
- CVE-2016-8621
- CVE-2016-8622
- CVE-2016-8623
- CVE-2016-8624
- CVE-2016-9586
- CVE-2017-1000100
- CVE-2017-1000101
- CVE-2017-7407
openssl:
- CVE-2016-2105
- CVE-2016-2106
- CVE-2016-2107
- CVE-2016-2108
- CVE-2016-2109
- CVE-2016-2177
- CVE-2016-2178
- CVE-2016-2179
- CVE-2016-2180
- CVE-2016-2181
- CVE-2016-2182
- CVE-2016-2183
- CVE-2016-6302
- CVE-2016-6303
- CVE-2016-6304
- CVE-2016-6306
libxml2:
- CVE-2014-0191
- CVE-2015-8806
- CVE-2016-1762
- CVE-2016-1833
- CVE-2016-1834
- CVE-2016-1835
- CVE-2016-1837
- CVE-2016-1838
- CVE-2016-1839
- CVE-2016-1840
- CVE-2016-2073
- CVE-2016-3627
- CVE-2016-3705
- CVE-2016-4447
- CVE-2016-4448
- CVE-2016-4449
- CVE-2016-4483
- CVE-2016-4658
- CVE-2016-9318
- CVE-2016-9597
- CVE-2017-9047
- CVE-2017-9048
- CVE-2017-9049
- CVE-2017-9050
util-linux:
- CVE-2015-5218
- CVE-2016-5011
- CVE-2017-2616
cracklib:
- CVE-2016-6318
systemd:
- CVE-2014-9770
- CVE-2015-8842
- CVE-2016-7796
pcre:
- CVE-2014-8964
- CVE-2015-2325
- CVE-2015-2327
- CVE-2015-2328
- CVE-2015-3210
- CVE-2015-3217
- CVE-2015-5073
- CVE-2015-8380
- CVE-2015-8381
- CVE-2015-8382
- CVE-2015-8383
- CVE-2015-8384
- CVE-2015-8385
- CVE-2015-8386
- CVE-2015-8387
- CVE-2015-8388
- CVE-2015-8389
- CVE-2015-8390
- CVE-2015-8391
- CVE-2015-8392
- CVE-2015-8393
- CVE-2015-8394
- CVE-2015-8395
- CVE-2016-1283
- CVE-2016-3191
appamor:
- CVE-2017-6507
bash:
- CVE-2014-6277
- CVE-2014-6278
- CVE-2016-0634
- CVE-2016-7543
cpio:
- CVE-2016-2037
glibc:
- CVE-2016-1234
- CVE-2016-3075
- CVE-2016-3706
- CVE-2016-4429
- CVE-2017-1000366
perl:
- CVE-2015-8853
- CVE-2016-1238
- CVE-2016-2381
- CVE-2016-6185
libssh2_org:
- CVE-2016-0787
expat:
- CVE-2012-6702
- CVE-2015-1283
- CVE-2016-0718
- CVE-2016-5300
- CVE-2016-9063
- CVE-2017-9233
ncurses:
- CVE-2017-10684
- CVE-2017-10685
- CVE-2017-11112
- CVE-2017-11113
libksba:
- CVE-2016-4574
- CVE-2016-4579
libgcrypt:
- CVE-2015-7511
- CVE-2016-6313
- CVE-2017-7526
dbus-1:
- CVE-2014-7824
- CVE-2015-0245
Finally, the following packages received non-security fixes:
- augeas
- bzip2
- ca-certificates-mozilla
- coreutils
- cryptsetup
- cyrus-sasl
- dirmngr
- e2fsprogs
- findutils
- gpg2
- insserv-compat
- kmod
- libcap
- libsolv
- libzypp
- openldap2
- p11-kit
- permissions
- procps
- rpm
- sed
- shadow
- zypper
- Record
SUSE-SU-2017:2699-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2700-1 No score
Security update for SLES 12-SP1 Docker image
The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.
The following issues related to building of the container images have been fixed:
- Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
- Do not install recommended packages when building container images. (bsc#975726)
A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.
pam:
- CVE-2015-3238
libtasn1:
- CVE-2015-3622
- CVE-2016-4008
expat:
expat:
- CVE-2012-6702
- CVE-2015-1283
- CVE-2016-0718
- CVE-2016-5300
- CVE-2016-9063
- CVE-2017-9233
libidn:
- CVE-2015-2059
- CVE-2015-8948
- CVE-2016-6261
- CVE-2016-6262
- CVE-2016-6263
zlib:
- CVE-2016-9840
- CVE-2016-9841
- CVE-2016-9842
- CVE-2016-9843
curl:
- CVE-2016-5419
- CVE-2016-5420
- CVE-2016-5421
- CVE-2016-7141
- CVE-2016-7167
- CVE-2016-8615
- CVE-2016-8616
- CVE-2016-8617
- CVE-2016-8618
- CVE-2016-8619
- CVE-2016-8620
- CVE-2016-8621
- CVE-2016-8622
- CVE-2016-8623
- CVE-2016-8624
- CVE-2016-9586
- CVE-2017-1000100
- CVE-2017-1000101
- CVE-2017-7407
openssl:
- CVE-2016-2105
- CVE-2016-2106
- CVE-2016-2107
- CVE-2016-2108
- CVE-2016-2109
- CVE-2016-2177
- CVE-2016-2178
- CVE-2016-2179
- CVE-2016-2180
- CVE-2016-2181
- CVE-2016-2182
- CVE-2016-2183
- CVE-2016-6302
- CVE-2016-6303
- CVE-2016-6304
- CVE-2016-6306
- CVE-2016-7056
- CVE-2016-8610
- CVE-2017-3731
cracklib:
- CVE-2016-6318
pcre:
- CVE-2014-8964
- CVE-2015-2325
- CVE-2015-2327
- CVE-2015-2328
- CVE-2015-3210
- CVE-2015-3217
- CVE-2015-5073
- CVE-2015-8380
- CVE-2015-8381
- CVE-2015-8382
- CVE-2015-8383
- CVE-2015-8384
- CVE-2015-8385
- CVE-2015-8386
- CVE-2015-8387
- CVE-2015-8388
- CVE-2015-8389
- CVE-2015-8390
- CVE-2015-8391
- CVE-2015-8392
- CVE-2015-8393
- CVE-2015-8394
- CVE-2015-8395
- CVE-2016-1283
- CVE-2016-3191
appamor:
- CVE-2017-6507
bash:
- CVE-2014-6277
- CVE-2014-6278
- CVE-2016-0634
- CVE-2016-7543
cpio:
- CVE-2016-2037
glibc:
- CVE-2016-1234
- CVE-2016-3075
- CVE-2016-3706
- CVE-2016-4429
- CVE-2017-1000366
perl:
- CVE-2015-8853
- CVE-2016-1238
- CVE-2016-2381
- CVE-2016-6185
libssh2_org:
- CVE-2016-0787
util-linux:
- CVE-2016-5011
- CVE-2017-2616
ncurses:
- CVE-2017-10684
- CVE-2017-10685
- CVE-2017-11112
- CVE-2017-11113
libksba:
- CVE-2016-4574
- CVE-2016-4579
libxml2:
- CVE-2014-0191
- CVE-2015-8806
- CVE-2016-1762
- CVE-2016-1833
- CVE-2016-1834
- CVE-2016-1835
- CVE-2016-1837
- CVE-2016-1838
- CVE-2016-1839
- CVE-2016-1840
- CVE-2016-2073
- CVE-2016-3627
- CVE-2016-3705
- CVE-2016-4447
- CVE-2016-4448
- CVE-2016-4449
- CVE-2016-4483
- CVE-2016-4658
- CVE-2016-9318
- CVE-2016-9597
- CVE-2017-9047
- CVE-2017-9048
- CVE-2017-9049
- CVE-2017-9050
libgcrypt:
- CVE-2015-7511
- CVE-2016-6313
- CVE-2017-7526
update-alternatives:
- CVE-2015-0860
systemd:
- CVE-2014-9770
- CVE-2015-8842
- CVE-2016-7796
dbus-1:
- CVE-2014-7824
- CVE-2015-0245
Finally, the following packages received non-security fixes:
- augeas
- bzip2
- ca-certificates-mozilla
- coreutils
- cryptsetup
- cyrus-sasl
- dirmngr
- e2fsprogs
- findutils
- gpg2
- insserv-compat
- kmod
- libcap
- libsolv
- libzypp
- lua51
- lvm2
- netcfg
- p11-kit
- permissions
- procps
- rpm
- sed
- sg3_utils
- shadow
- zypper
- Record
SUSE-SU-2017:2700-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0245 No score
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- Record
UBUNTU-CVE-2015-0245- Updated
- 2026-11-02
OSVUSN-3116-1 No score
dbus vulnerabilities
It was discovered that DBus incorrectly validated the source of ActivationFailure signals. A local attacker could use this issue to cause a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-0245)
It was discovered that DBus incorrectly handled certain format strings. A local attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue is only exposed to unprivileged users when the fix for CVE-2015-0245 is not applied, hence this issue is only likely to affect Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 16.04 LTS and Ubuntu 16.10 have been updated as a preventative measure in the event that a new attack vector for this issue is discovered. (No CVE number)
- Record
USN-3116-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbusDebian:12 |
before 1.8.16-1 | 1.8.16-1 |
dbusDebian:13 |
before 1.8.16-1 | 1.8.16-1 |
dbusDebian:14 |
before 1.8.16-1 | 1.8.16-1 |
dbusDebian:7 |
before 1.6.8-1+deb7u6, plus listed versions 1.6.8-11.6.8-1+deb7u11.6.8-1+deb7u21.6.8-1+deb7u31.6.8-1+deb7u41.6.8-1+deb7u5 |
1.6.8-1+deb7u6 |
dbusMageia:4 |
before 1.6.18-1.10.mga4 | 1.6.18-1.10.mga4 |
dbus-1SUSE:Linux Enterprise Desktop 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbus-1-x11SUSE:Linux Enterprise Desktop 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbus-1SUSE:Linux Enterprise Software Development Kit 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbus-1-x11SUSE:Linux Enterprise Software Development Kit 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbus-1SUSE:Linux Enterprise Server 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dbus-1-x11SUSE:Linux Enterprise Server 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbus-1SUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbus-1-x11SUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.8.16-14.1 | 1.8.16-14.1 |
dbusUbuntu:14.04:LTS |
before 1.6.18-0ubuntu4.4, plus listed versions 1.6.12-0ubuntu101.6.18-0ubuntu11.6.18-0ubuntu21.6.18-0ubuntu31.6.18-0ubuntu41.6.18-0ubuntu4.11.6.18-0ubuntu4.21.6.18-0ubuntu4.3 |
1.6.18-0ubuntu4.4 |
dbusUbuntu:16.04:LTS |
before 1.10.6-1ubuntu3.1, plus listed versions 1.10.0-1ubuntu11.10.4-1ubuntu21.10.6-1ubuntu11.10.6-1ubuntu21.10.6-1ubuntu3 |
1.10.6-1ubuntu3.1 |
dbus-1openSUSE:Tumbleweed |
before 1.10.12-2.1 | 1.10.12-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0245 is a low vulnerability (CVSS 1.9) in Freedesktop Dbus, published February 11, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in dbus 1.8.16-1.
References
oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
lists.opensuse.org/opensuse-updates/2015-02/msg00066.html
debian.org/security/2015/dsa-3161
openwall.com/lists/oss-security/2015/02/09/6
advisories.mageia.org/MGASA-2015-0071.html
mandriva.com/security/advisories?name=MDVSA-2015:176
Show 172 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-0245
github.com/advisories/GHSA-8jc2-f36v-gc57
security-tracker.debian.org/tracker/CVE-2015-0245
bugs.mageia.org/show_bug.cgi?id=15245
lists.freedesktop.org/archives/dbus/2015-February/016553.html
suse.com/support/update/announcement/2015/suse-su-20150457-1
bugzilla.suse.com/916343
ubuntu.com/security/CVE-2015-0245
cve.org/CVERecord?id=CVE-2015-0245