{"id":"CVE-2014-3635","aliases":["DEBIAN-CVE-2014-3635","DSA-3026-1","EUVD-2014-3593","GHSA-hm35-xvpf-f225","MGASA-2014-0395","UBUNTU-CVE-2014-3635","USN-2352-1","openSUSE-SU-2024:10517-1"],"status":"published","title":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running...","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","severity":{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00486,"percentile":0.42173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-09-16T00:00:00Z","modified":"2026-10-23T15:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"dbus","fixed_in":["1.8.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dbus","fixed_in":["1.8.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dbus","fixed_in":["1.8.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dbus","fixed_in":["1.6.18-0ubuntu4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-1+deb7u4"}]}],"versions":["1.6.8-1","1.6.8-1+deb7u1","1.6.8-1+deb7u2","1.6.8-1+deb7u3"],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.8-4.5.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-1.4.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-0ubuntu4.2"}]}],"versions":["1.6.12-0ubuntu10","1.6.18-0ubuntu1","1.6.18-0ubuntu2","1.6.18-0ubuntu3","1.6.18-0ubuntu4","1.6.18-0ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18-0ubuntu4.2"}]}],"versions":["1.6.12-0ubuntu10","1.6.18-0ubuntu1","1.6.18-0ubuntu2","1.6.18-0ubuntu3","1.6.18-0ubuntu4","1.6.18-0ubuntu4.1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.12-2.1"}]}],"bundled":14}],"products":[{"vendor":"d-bus_project","product":"d-bus"},{"vendor":"freedesktop","product":"dbus"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2352-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://bugs.freedesktop.org/show_bug.cgi?id=83622","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/61378","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/09/16/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.securitytracker.com/id/1030864","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0395.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3026","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:176","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3635"},{"url":"https://github.com/advisories/GHSA-hm35-xvpf-f225"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3635","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0395.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14102","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2014/09/16/9","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-3026","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3635","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2352-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3635","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3638","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3639","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0245","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3635","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2014-09-22T15:00:00Z","modified":"2024-08-06T10:50:18.235Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3593","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2014-09-22T15:00:00Z","modified":"2024-08-06T10:50:18Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-hm35-xvpf-f225","title":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running...","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2022-05-14T02:10:40Z","modified":"2023-02-02T05:05:18Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:04.117158Z"}],"nvd":[{"id":"CVE-2014-3635","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2014-09-22T15:55:07.983Z","modified":"2026-06-17T00:08:39.723Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:55.884979Z"}],"osv":[{"id":"CVE-2014-3635","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2014-09-22T15:55:07Z","modified":"2026-04-16T06:19:49.520440635Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3635","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2014-09-22T15:55:07.983Z","modified":"2026-10-23T15:47:25.848809535Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-3026-1","title":"dbus - security update","status":"published","published":"2014-09-16T00:00:00Z","modified":"2026-03-09T01:22:32.869119Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0395","title":"Updated dbus packages fix multiple security vulnerabilities","description":"Updated dbus packages fixes the following security issues:\n\nAlban Crequy and Simon McVittie discovered several vulnerabilities in the\nD-Bus message daemon:\n\nOn 64-bit platforms, file descriptor passing could be abused by local users\nto cause heap corruption in dbus-daemon, leading to a crash, or potentially\nto arbitrary code execution (CVE-2014-3635).\n\nA denial-of-service vulnerability in dbus-daemon allowed local attackers to\nprevent new connections to dbus-daemon, or disconnect existing clients, by\nexhausting descriptor limits (CVE-2014-3636).\n\nMalicious local users could create D-Bus connections to dbus-daemon which\ncould not be terminated by killing the participating processes, resulting\nin a denial-of-service vulnerability (CVE-2014-3637).\n\ndbus-daemon suffered from a denial-of-service vulnerability in the code\nwhich tracks which messages expect a reply, allowing local attackers to\nreduce the performance of dbus-daemon (CVE-2014-3638).\n\ndbus-daemon did not properly reject malicious connections from local users,\nresulting in a denial-of-service vulnerability (CVE-2014-3639).\n","status":"published","published":"2014-10-07T09:22:51Z","modified":"2026-04-16T06:24:37.309534061Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10517-1","title":"dbus-1-1.10.12-2.1 on GA media","description":"These are all security issues fixed in the dbus-1-1.10.12-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:46:59.021081Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2014-3635","description":"Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.","status":"published","published":"2014-09-17T00:00:00Z","modified":"2026-04-22T09:42:06.526454Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2352-1","title":"dbus vulnerabilities","description":"Simon McVittie discovered that DBus incorrectly handled the file\ndescriptors message limit. A local attacker could use this issue to cause\nDBus to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only applied to Ubuntu 12.04 LTS and Ubuntu\n14.04 LTS. (CVE-2014-3635)\n\nAlban Crequy discovered that DBus incorrectly handled a large number of\nfile descriptor messages. A local attacker could use this issue to cause\nDBus to stop responding, resulting in a denial of service. This issue only\napplied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3636)\n\nAlban Crequy discovered that DBus incorrectly handled certain file\ndescriptor messages. A local attacker could use this issue to cause DBus\nto maintain persistent connections, possibly resulting in a denial of\nservice. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.\n(CVE-2014-3637)\n\nAlban Crequy discovered that DBus incorrectly handled a large number of\nparallel connections and parallel message calls. A local attacker could use\nthis issue to cause DBus to consume resources, possibly resulting in a\ndenial of service. (CVE-2014-3638)\n\nAlban Crequy discovered that DBus incorrectly handled incomplete\nconnections. A local attacker could use this issue to cause DBus to fail\nlegitimate connection attempts, resulting in a denial of service.\n(CVE-2014-3639)\n","status":"published","published":"2014-09-22T17:08:16Z","modified":"2026-04-22T09:02:07.576541Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}