CVE-2009-1189
Fixed in a distro release EPSS 1%
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
Products: freedesktop dbus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | dbus | 1.2.14-1 |
| Debian 13 | dbus | 1.2.14-1 |
| Debian 14 | dbus | 1.2.14-1 |
| Debian 4.0 | dbus | 1.0.2-1+etch3 |
| Debian 5.0 | dbus | 1.2.1-5+lenny1 |
| Red Hat Enterprise Linux 5 | dbus | 0:1.1.2-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | dbus-debuginfo | 0:1.1.2-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | dbus-devel | 0:1.1.2-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | dbus-libs | 0:1.1.2-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | dbus-x11 | 0:1.1.2-12.el5_4.1 |