Announcing security release D-Bus 1.10.12

Simon McVittie <simon.mcvittie-ZGY8ohtN/[email protected]> Mon, 10 Oct 2016 13:33:13 +0100

Newsgroups	gmane.comp.freedesktop.dbus
Organization	Collabora Ltd.
Message-ID	<[email protected]>

The “not excessively inhospitable” release.

http://dbus.freedesktop.org/releases/dbus/dbus-1.10.12.tar.gz
http://dbus.freedesktop.org/releases/dbus/dbus-1.10.12.tar.gz.asc
git tag: dbus-1.10.12

Security fixes:

• Do not treat ActivationFailure message received from root-owned
  systemd name as a format string. In principle this is a security
  vulnerability, but we do not believe it is exploitable in practice,
  because only privileged processes can own the
  org.freedesktop.systemd1 bus name, and systemd does not appear to
  send activation failures that contain "%".

  Please note that this probably *was* exploitable in dbus versions
  older than 1.6.30, 1.8.16 and 1.9.10 due to a missing check which at
  the time was only thought to be a denial of service vulnerability
  (CVE-2015-0245). If you are still running one of those versions,
  patch or upgrade immediately.

  (fd.o #98157, Simon McVittie)

Other fixes:

• Harden dbus-daemon against malicious or incorrect ActivationFailure
  messages by rejecting them if they do not come from a privileged
  process, or if systemd activation is not enabled
  (fd.o #98157, Simon McVittie)

• Avoid undefined behaviour when setting reply serial number without
  going via union DBusBasicValue (fd.o #98035, Marc Mutz)

• autogen.sh: fail cleanly if autoconf fails (Simon McVittie)

-- 
Simon McVittie, Collabora Ltd. <http://www.collabora.com/>

_______________________________________________
dbus mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dbus

signature.asc (application/pgp-signature, 845 B)