{"id":"CVE-2013-2168","aliases":["DEBIAN-CVE-2013-2168","DSA-2707-1","EUVD-2013-2128","GHSA-c26p-366m-4xv6","MGASA-2013-0173","openSUSE-SU-2024:10517-1"],"status":"published","title":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4...","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","severity":{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00383,"percentile":0.3261,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-06-13T00:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"dbus","fixed_in":["1.6.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dbus","fixed_in":["1.6.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dbus","fixed_in":["1.6.12-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"dbus","fixed_in":["1.6.8-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"dbus","fixed_in":["1.4.16-5.2.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"dbus","fixed_in":["1.6.8-4.1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1+deb7u1"}]}],"versions":["1.6.8-1"]},{"source":"osv","ecosystem":"Mageia:2","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.16-5.2.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-4.1.mga3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.12-2.1"}]}],"bundled":14}],"products":[{"vendor":"freedesktop","product":"dbus"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.debian.org/security/2013/dsa-2707","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-June/110114.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:177","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-07/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/53317","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109896.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974109","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16881","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1028667","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://cgit.freedesktop.org/dbus/dbus/commit/?id=954d75b2b64e4799f360d2a6bf9cff6d9fee37e7","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1874-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/06/13/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/53832","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.freedesktop.org/archives/dbus/2013-June/015696.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/60546","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2168"},{"url":"https://github.com/advisories/GHSA-c26p-366m-4xv6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2168","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0173.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10520","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2168","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","status":"published","published":"2013-07-03T18:00:00Z","modified":"2024-08-06T15:27:41.099Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2128","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","status":"published","published":"2013-07-03T18:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-c26p-366m-4xv6","title":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4...","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","status":"published","published":"2022-05-14T02:10:10Z","modified":"2023-02-02T05:05:02Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:01.039764Z"}],"nvd":[{"id":"CVE-2013-2168","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","status":"published","published":"2013-07-03T18:55:01.08Z","modified":"2026-06-16T23:52:52.583Z","cvss":[{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"CVE-2013-2168","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","status":"published","published":"2013-07-03T18:55:01Z","modified":"2026-04-16T04:36:27.391059804Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2168","description":"The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.","status":"published","published":"2013-07-03T18:55:01.08Z","modified":"2026-09-01T20:03:15.5454645Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2707-1","title":"dbus - denial of service","status":"published","published":"2013-06-13T00:00:00Z","modified":"2026-03-09T01:21:13.569779Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0173","title":"Updated dbus packages fix security vulnerability","description":"Alexandru Cornea discovered a vulnerability in libdbus caused by an\nimplementation bug in _dbus_printf_string_upper_bound(). This\nvulnerability can be exploited by a local user to crash system services\nthat use libdbus, causing denial of service. Depending on the dbus\nservices running, it could lead to complete system crash (CVE-2013-2168).\n\nThis problem only currently appears to affect the x86_64 version of Mageia\nbut we advise that all systems should be updated.\n","status":"published","published":"2013-06-18T15:07:38Z","modified":"2026-04-16T04:42:16.401679832Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10517-1","title":"dbus-1-1.10.12-2.1 on GA media","description":"These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:59.021081Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}