{"id":"CVE-2014-3477","aliases":["DEBIAN-CVE-2014-3477","DLA-87-1","DSA-2971-1","EUVD-2014-3486","GHSA-qj2p-fqqf-6x63","MGASA-2014-0266","UBUNTU-CVE-2014-3477","USN-2275-1","openSUSE-SU-2024:10517-1"],"status":"published","title":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends...","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00444,"percentile":0.38889,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-06-18T19:25:42Z","modified":"2026-10-23T16:00:41Z","fixes":[{"ecosystem":"Debian:12","package":"dbus","fixed_in":["1.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dbus","fixed_in":["1.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dbus","fixed_in":["1.8.4-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"dbus","fixed_in":["1.6.8-4.2.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"dbus","fixed_in":["1.6.18-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dbus","fixed_in":["1.6.18-0ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.24-4+squeeze3"}]}],"versions":["1.2.24-4","1.2.24-4+squeeze1","1.2.24-4+squeeze2"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1+deb7u3"}]}],"versions":["1.6.8-1","1.6.8-1+deb7u1","1.6.8-1+deb7u2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:3","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-4.2.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-0ubuntu4.1"}]}],"versions":["1.6.12-0ubuntu10","1.6.18-0ubuntu1","1.6.18-0ubuntu2","1.6.18-0ubuntu3","1.6.18-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-0ubuntu4.1"}]}],"versions":["1.6.12-0ubuntu10","1.6.18-0ubuntu1","1.6.18-0ubuntu2","1.6.18-0ubuntu3","1.6.18-0ubuntu4"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.12-2.1"}]}],"bundled":14}],"products":[{"vendor":"d-bus_project","product":"d-bus"},{"vendor":"freedesktop","product":"dbus"}],"references":[{"url":"http://secunia.com/advisories/59798","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59611","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/67986","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-07/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://seclists.org/oss-sec/2014/q2/509","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-06/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0266.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59428","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://bugs.freedesktop.org/show_bug.cgi?id=78979","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8\u0026id=24c590703ca47eb71ddef453de43126b90954567","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.debian.org/security/2014/dsa-2971","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:176","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3477"},{"url":"https://github.com/advisories/GHSA-qj2p-fqqf-6x63"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3477","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0266.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13513","tags":["report"]},{"url":"http://lists.freedesktop.org/archives/dbus/2014-June/016220.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3477","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2275-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3533","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3477","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2014-07-01T17:00:00Z","modified":"2025-01-16T20:11:35.974Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3486","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2014-07-01T17:00:00Z","modified":"2025-01-16T20:11:35Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:18.077485Z"}],"ghsa":[{"id":"GHSA-qj2p-fqqf-6x63","title":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends...","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2022-05-17T04:14:03Z","modified":"2025-01-16T21:31:58Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T14:59:35.190753Z"}],"nvd":[{"id":"CVE-2014-3477","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2014-07-01T17:55:04.277Z","modified":"2026-06-17T00:08:15.99Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"DEBIAN-CVE-2014-3477","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2014-07-01T17:55:04.277Z","modified":"2026-10-23T16:00:41.51703146Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-3477","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2014-07-01T00:00:00Z","modified":"2026-04-22T09:39:38.653647Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"CVE-2014-3477","description":"The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.","status":"published","published":"2014-07-01T17:55:04Z","modified":"2026-04-16T06:20:42.217226312Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DLA-87-1","title":"dbus - security update","status":"published","published":"2014-11-20T00:00:00Z","modified":"2026-03-09T02:08:34.690113Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-2971-1","title":"dbus - security update","status":"published","published":"2014-07-02T00:00:00Z","modified":"2026-03-09T01:22:30.234018Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0266","title":"Updated dbus packages fix security vulnerability","description":"Updated dbus packages fix security vulnerability:\n\nA denial of service vulnerability in D-Bus before 1.6.20 allows a local\nattacker to cause a bus-activated service that is not currently running\nto attempt to start, and fail, denying other users access to this service\nAdditionally, in highly unusual environments the same flaw could lead to\na side channel between processes that should not be able to communicate\n(CVE-2014-3477).\n","status":"published","published":"2014-06-18T19:25:42Z","modified":"2026-04-16T06:26:03.747222013Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10517-1","title":"dbus-1-1.10.12-2.1 on GA media","description":"These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:59.021081Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-2275-1","title":"dbus vulnerabilities","description":"Alban Crequy discovered that dbus-daemon incorrectly sent AccessDenied\nerrors to the service instead of the client when enforcing permissions. A\nlocal user can use this issue to possibly deny access to the service.\n(CVE-2014-3477)\n\nAlban Crequy discovered that dbus-daemon incorrectly handled certain file\ndescriptors. A local attacker could use this issue to cause services or\nclients to disconnect, resulting in a denial of service. (CVE-2014-3532,\nCVE-2014-3533)\n","status":"published","published":"2014-07-08T17:27:04Z","modified":"2026-04-22T08:57:57.404464Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}