CVE-2008-4311
Fixed in a distro release EPSS <1%
The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.
Products: freedesktop dbus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | dbus | 1.2.1-5 |
| Debian 13 | dbus | 1.2.1-5 |
| Debian 14 | dbus | 1.2.1-5 |
| openSUSE Tumbleweed | PackageKit | 1.2.2-13.2 |
| openSUSE Tumbleweed | dbus-1 | 1.12.20-5.5 |
| openSUSE Tumbleweed | yast2-core | 4.4.0-1.4 |