{"id":"CVE-2020-35512","aliases":["CLSA-2022-1669241224","DEBIAN-CVE-2020-35512","EUVD-2020-23179","GHSA-f5qm-fxvw-fwjg","OESA-2021-1101","SUSE-SU-2021:2211-1","SUSE-SU-2021:2292-1","SUSE-SU-2021:2424-1","SUSE-SU-2021:2590-1","SUSE-SU-2022:2788-1","UBUNTU-CVE-2020-35512","USN-5244-1","USN-5244-2","openSUSE-SU-2021:1056-1","openSUSE-SU-2021:2292-1"],"status":"published","title":"A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the...","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00335,"percentile":0.27255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-02-15T16:08:39Z","modified":"2026-10-26T12:01:59Z","fixes":[{"ecosystem":"Debian:12","package":"dbus","fixed_in":["1.12.20-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dbus","fixed_in":["1.12.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dbus","fixed_in":["1.12.20-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"dbus","fixed_in":["1.12.16-17.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"dbus","fixed_in":["1.12.16-17.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dbus-1","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dbus-1-x11","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dbus-1","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dbus-1-x11","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dbus-1","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dbus-1-x11","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dbus-1","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dbus-1-x11","fixed_in":["1.12.2-3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dbus-1","fixed_in":["1.8.22-24.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dbus-1-x11","fixed_in":["1.8.22-24.22.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dbus","fixed_in":["1.10.6-1ubuntu3.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"dbus","fixed_in":["1.12.2-1ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"dbus","fixed_in":["1.12.16-2ubuntu2.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"dbus-1","fixed_in":["1.12.2-lp152.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"dbus-1-x11","fixed_in":["1.12.2-lp152.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"dbus-1","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"dbus-1-x11","fixed_in":["1.12.2-8.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"dbus-1-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"dbus-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"dbus-user-session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"dbus-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libdbus-1-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libdbus-1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.20-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.20-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.16-17.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.16-17.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-35.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-35.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-35.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-35.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-35.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-35.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-29.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-24.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.22-24.22.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.12-0ubuntu10","1.6.18-0ubuntu1","1.6.18-0ubuntu2","1.6.18-0ubuntu3","1.6.18-0ubuntu4","1.6.18-0ubuntu4.1","1.6.18-0ubuntu4.2","1.6.18-0ubuntu4.3","1.6.18-0ubuntu4.4","1.6.18-0ubuntu4.5","1.6.18-0ubuntu4.5+esm1","1.6.18-0ubuntu4.5+esm2","1.6.18-0ubuntu4.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+esm1"}]}],"versions":["1.10.0-1ubuntu1","1.10.4-1ubuntu2","1.10.6-1ubuntu1","1.10.6-1ubuntu2","1.10.6-1ubuntu3","1.10.6-1ubuntu3.1","1.10.6-1ubuntu3.3","1.10.6-1ubuntu3.4","1.10.6-1ubuntu3.5","1.10.6-1ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-1ubuntu1.3"}]}],"versions":["1.10.22-1ubuntu1","1.12.0-1ubuntu1","1.12.2-1ubuntu1","1.12.2-1ubuntu1.1","1.12.2-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.16-2ubuntu2.2"}]}],"versions":["1.12.14-1ubuntu2","1.12.16-2ubuntu1","1.12.16-2ubuntu2","1.12.16-2ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-1ubuntu3.6+esm1"}]}],"versions":["1.10.0-1ubuntu1","1.10.4-1ubuntu2","1.10.6-1ubuntu1","1.10.6-1ubuntu2","1.10.6-1ubuntu3","1.10.6-1ubuntu3.1","1.10.6-1ubuntu3.3","1.10.6-1ubuntu3.4","1.10.6-1ubuntu3.5","1.10.6-1ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-1ubuntu1.3"}]}],"versions":["1.10.22-1ubuntu1","1.12.0-1ubuntu1","1.12.2-1ubuntu1","1.12.2-1ubuntu1.1","1.12.2-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dbus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.16-2ubuntu2.2"}]}],"versions":["1.12.14-1ubuntu2","1.12.16-2ubuntu1","1.12.16-2ubuntu2","1.12.16-2ubuntu2.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-lp152.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-lp152.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"dbus-1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"dbus-1-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-8.6.1"}]}]}],"products":[{"vendor":"freedesktop","product":"dbus"}],"references":[{"url":"https://bugs.gentoo.org/755392","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1909101","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35512","tags":["x_refsource_MISC","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35512","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f5qm-fxvw-fwjg"},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2022-1669241224","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1101","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212211-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187105","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35512","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212424-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172505","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12049","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212590-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222788-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35512","tags":["report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305","tags":["report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/commit/2b7948ef907669e844b52c4fa2268d6e3162a70c","tags":["report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/commit/f3b2574f0c9faa32a59efec905921f7ef4438a60","tags":["report"]},{"url":"https://gitlab.freedesktop.org/dbus/dbus/-/commit/dc94fe3d31adf72259adc31f343537151a6c0bdd","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5244-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5244-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35512","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SMJEHJSAVUMBFKW6O66TYUT5LCUVZD6Z/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YPWMH7OQGRFBQ2ZFL5Z3HCT443A45EIB/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2021-02-15T16:08:39Z","modified":"2024-11-19T15:32:44.371Z","updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-23179","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2021-02-15T16:08:39Z","modified":"2024-11-19T15:32:44Z","updated_at":"2026-11-03T00:04:56.132572Z"}],"ghsa":[{"id":"GHSA-f5qm-fxvw-fwjg","title":"A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the...","description":"A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2022-05-24T17:42:10Z","modified":"2023-12-27T18:30:20Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:55:16.928981Z"}],"nvd":[{"id":"CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2021-02-15T17:15:12.993Z","modified":"2026-06-17T03:13:50.667Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2021-02-15T17:15:12.993Z","modified":"2026-04-10T04:27:00.249128Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2021-02-15T17:15:12.993Z","modified":"2026-10-26T12:01:59.357011855Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"OESA-2021-1101","title":"dbus security update","description":"D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it makes it simple and reliable to code a \u0026quot;single instance\u0026quot; application or daemon, and to launch applications and daemons on demand when their services are needed.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in D-Bus Development branch \u0026lt;= 1.13.16, dbus-1.12.x stable branch \u0026lt;= 1.12.18, and dbus-1.10.x and older branches \u0026lt;= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors(CVE-2020-35512)","status":"published","published":"2021-04-07T11:04:20Z","modified":"2026-08-18T01:15:23.008565853Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-35512","description":"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors","status":"published","published":"2021-02-15T17:15:00Z","modified":"2026-04-22T12:40:01.472219Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"CLSA-2022-1669241224","title":"Fix CVE(s): CVE-2022-42012, CVE-2022-42011, CVE-2022-42010, CVE-2020-35512","description":"\n   * SECURITY UPDATE: Use-after-free in access control-related hash tables\n     - debian/patches/CVE-2020-35512.patch: use reference counting for\n       DBusUserInfo and DBusGroupInfo structures.\n     - CVE-2020-35512\n   * SECURITY UPDATE: Crash or incorrect parsing a signature with wrongly\n     nested '()' and '{}'\n     - debian/patches/CVE-2022-42010.patch: add extra checking for brackets.\n     - CVE-2022-42010\n   * SECURITY UPDATE: Out-of-bounds accesses during processing of arrays\n     made up of an integer number of items\n     - debian/patches/CVE-2022-42011.patch: validate length of arrays of\n       fixed-length items.\n     - CVE-2022-42011\n   * SECURITY UPDATE: Crash when message type and the pointer into its\n     contents goes out of sync\n     - debian/patches/CVE-2022-42012.patch: byte-swap Unix fd indexes\n       if needed.\n     - CVE-2022-42012","status":"published","published":"2022-11-23T22:07:04Z","modified":"2026-06-04T10:04:06.590806344Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"openSUSE-SU-2021:1056-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-07-19T21:03:37Z","modified":"2026-02-04T02:18:11.283316Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2292-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)\n","status":"published","published":"2021-07-12T06:25:40Z","modified":"2026-02-04T03:34:04.424904Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:2211-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)\n","status":"published","published":"2021-06-30T13:58:18Z","modified":"2026-02-04T03:39:17.448363Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2292-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)\n","status":"published","published":"2021-07-12T06:25:55Z","modified":"2026-02-04T04:35:13.883796Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2424-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: users with the same numeric UID could lead to use-after-free and undefined behaviour (bsc#1187105)\n- CVE-2020-12049: truncated messages lead to resource exhaustion (bsc#1172505)\n","status":"published","published":"2021-07-21T09:25:48Z","modified":"2026-02-04T04:34:45.454998Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2590-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: Fixed a bug where users with the same numeric UID could lead to use-after-free and undefined behaviour. (bsc#1187105)\n- CVE-2020-12049: Fixed a bug where a truncated messages lead to resource exhaustion. (bsc#1172505)\n","status":"published","published":"2021-08-02T10:53:19Z","modified":"2026-02-04T04:31:05.850233Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:2788-1","title":"Security update for dbus-1","description":"This update for dbus-1 fixes the following issues:\n\n- CVE-2020-35512: Fixed a memory safety issue which affected systems\n  with users with the same numeric UID (bsc#1187105).\n","status":"published","published":"2022-08-11T14:42:27Z","modified":"2026-02-04T02:44:51.35993Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5244-1","title":"dbus vulnerability","description":"Daniel Onaca discovered that DBus contained a use-after-free vulnerability,\ncaused by the incorrect handling of usernames sharing the same UID. An\nattacker could possibly use this issue to cause DBus to crash, resulting\nin a denial of service.\n","status":"published","published":"2022-01-20T19:51:21Z","modified":"2026-06-25T13:30:58.659933589Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5244-2","title":"dbus vulnerability","description":"USN-5244-1 fixed a vulnerability in DBus. This update provides\nthe corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n Daniel Onaca discovered that DBus contained a use-after-free vulnerability,\n caused by the incorrect handling of usernames sharing the same UID. An\n attacker could possibly use this issue to cause DBus to crash, resulting\n in a denial of service.\n","status":"published","published":"2022-05-09T05:55:53Z","modified":"2026-04-27T15:28:04.117782Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}