Every CVE Search/ Get API key

CVE-2012-3524

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly...

6.9 MediumPublic exploitFix available

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Exploit likelihood

4.48%Up 2.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.9

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Record
CVE-2012-3524
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Record
CVE-2012-3524
Updated
2026-11-02
EUVDEUVD-2012-3479 No score

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Record
EUVD-2012-3479
Updated
2026-11-03
GitHub AdvisoriesGHSA-qw63-7rfw-9cx5 No score

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly...

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Record
GHSA-qw63-7rfw-9cx5
Updated
2026-11-02
OSVBELL-CVE-2012-3524 6.9

CVE-2012-3524 does not affect BellSoft software

Record
BELL-CVE-2012-3524
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Updated
2026-11-02
OSV No score

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Record
CVE-2012-3524
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3524 No score

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Record
DEBIAN-CVE-2012-3524
Updated
2026-11-02
OSVopenSUSE-SU-2024:10473-1 No score

gio-branding-upstream-2.50.2-1.1 on GA media

These are all security issues fixed in the gio-branding-upstream-2.50.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10473-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10517-1 No score

dbus-1-1.10.12-2.1 on GA media

These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10517-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dbus
Debian:12
 before 1.6.8-1
1.6.8-1
dbus
Debian:13
 before 1.6.8-1
1.6.8-1
dbus
Debian:14
 before 1.6.8-1
1.6.8-1
glib2.0
Debian:12
 before 2.33.12+really2.32.4-2
2.33.12+really2.32.4-2
glib2.0
Debian:13
 before 2.33.12+really2.32.4-2
2.33.12+really2.32.4-2
glib2.0
Debian:14
 before 2.33.12+really2.32.4-2
2.33.12+really2.32.4-2
dbus
Red Hat:enterprise_linux:6::client
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-debuginfo
Red Hat:enterprise_linux:6::client
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-libs
Red Hat:enterprise_linux:6::client
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-x11
Red Hat:enterprise_linux:6::client
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
Show 21 moreShow less
Affected packages
PackageAffectedFixed
dbus-devel
Red Hat:enterprise_linux:6::client
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-doc
Red Hat:enterprise_linux:6::client
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus
Red Hat:enterprise_linux:6::computenode
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-libs
Red Hat:enterprise_linux:6::computenode
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-x11
Red Hat:enterprise_linux:6::computenode
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-devel
Red Hat:enterprise_linux:6::computenode
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-doc
Red Hat:enterprise_linux:6::computenode
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus
Red Hat:enterprise_linux:6::server
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-debuginfo
Red Hat:enterprise_linux:6::server
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-devel
Red Hat:enterprise_linux:6::server
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-libs
Red Hat:enterprise_linux:6::server
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-x11
Red Hat:enterprise_linux:6::server
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-doc
Red Hat:enterprise_linux:6::server
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus
Red Hat:enterprise_linux:6::workstation
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-devel
Red Hat:enterprise_linux:6::workstation
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-libs
Red Hat:enterprise_linux:6::workstation
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-x11
Red Hat:enterprise_linux:6::workstation
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-doc
Red Hat:enterprise_linux:6::workstation
 before 1:1.2.24-7.el6_3
1:1.2.24-7.el6_3
dbus-1
openSUSE:Tumbleweed
 before 1.10.12-2.1
1.10.12-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBlibdbus - 'DBUS_SYSTEM_BUS_ADDRESS' Local Privilege Escalation2012-07-17

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3524 is a medium vulnerability (CVSS 6.9) in Freedesktop Libdbus, published September 18, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.48%, the 91st percentile. Fixed in dbus 1.6.8-1.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open