https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:49:16.067587+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:61340 ALSA-2026:61340 — Moderate: dbus-broker security update 2026-10-02T17:49:16.244954+00:00

Affected: AlmaLinux:10: dbus-broker

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.

Security Fix(es):

* dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/euvd-2026-366501 EUVD-2026-366501 2026-10-02T17:49:16.245023+00:00 EUVD-2026-366501 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16730 fkie_cve-2026-16730 2026-10-02T17:49:16.245039+00:00

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

 https://cve.radiocsirt.org/vuln/ghsa-77qf-9j4m-ph58 GHSA-77qf-9j4m-ph58 2026-10-02T17:49:16.245064+00:00

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

 https://cve.radiocsirt.org/vuln/rhsa-2026:61340 RHSA-2026:61340 — Red Hat Security Advisory: dbus-broker security update 2026-10-02T17:49:16.245080+00:00

dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup

 https://cve.radiocsirt.org/vuln/rhsa-2026:66018 RHSA-2026:66018 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update 2026-10-02T17:49:16.245097+00:00

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect tar: tar: Hidden file injection via crafted archives libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free curl: curl: Insecure connection establishment due to TLS configuration mismatch curl: curl: Man-in-the-middle attack via SSH host key bypass sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility gzip: gzip: Information disclosure via global buffer overflow in LZH decompression python-idna: idna: Denial of Service via specially crafted long inputs attr: attr: Symlink Traversal Privilege Escala…

 https://cve.radiocsirt.org/vuln/rlsa-2026:61340 RLSA-2026:61340 — Moderate: dbus-broker security update 2026-10-02T17:49:16.245169+00:00

Affected: Rocky Linux:10: dbus-broker

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.

Security Fix(es):

* dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-16730 UBUNTU-CVE-2026-16730 2026-10-02T17:49:16.245194+00:00

Affected: Ubuntu:22.04:LTS: dbus-broker, Ubuntu:24.04:LTS: dbus-broker, Ubuntu:26.04:LTS: dbus-broker

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3095 WID-SEC-W-2026-3095 — Red Hat Enterprise Linux (pipewire,dbus-broker): Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-02T17:49:16.245217+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.