https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:43:36 +0000 https://cve.radiocsirt.org/vuln/bdu:2019-03326 bdu:2019-03326 https://cve.radiocsirt.org/vuln/bdu:2019-03326 https://cve.radiocsirt.org/vuln/bell-cve-2019-12749 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2019-12749 https://cve.radiocsirt.org/vuln/certfr-2020-avi-015 certfr-2020-avi-015 https://cve.radiocsirt.org/vuln/certfr-2020-avi-015 https://cve.radiocsirt.org/vuln/cnvd-2019-19472 cnvd-2019-19472 https://cve.radiocsirt.org/vuln/cnvd-2019-19472 https://cve.radiocsirt.org/vuln/euvd-2026-268618 EUVD-2026-268618 https://cve.radiocsirt.org/vuln/euvd-2026-268618 https://cve.radiocsirt.org/vuln/fkie_cve-2019-12749 <p>dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.</p> <p>dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-12749 https://cve.radiocsirt.org/vuln/ghsa-2hpj-v4f4-7g4j <p>dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.</p> <p>dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.</p> https://cve.radiocsirt.org/vuln/ghsa-2hpj-v4f4-7g4j https://cve.radiocsirt.org/vuln/gsd-2019-12749 gsd-2019-12749 https://cve.radiocsirt.org/vuln/gsd-2019-12749 https://cve.radiocsirt.org/vuln/msrc_cve-2019-12749 msrc_CVE-2019-12749 https://cve.radiocsirt.org/vuln/msrc_cve-2019-12749 https://cve.radiocsirt.org/vuln/opensuse-su-2019:1604-1 <p>Security update for dbus-1</p> <p>Security update for dbus-1</p> https://cve.radiocsirt.org/vuln/opensuse-su-2019:1604-1 https://cve.radiocsirt.org/vuln/rhsa-2019:1726 <p>dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass</p> <p>dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass</p> https://cve.radiocsirt.org/vuln/rhsa-2019:1726 https://cve.radiocsirt.org/vuln/suse-su-2019:14111-1 <p>Security update for dbus-1</p> <p>Security update for dbus-1</p> https://cve.radiocsirt.org/vuln/suse-su-2019:14111-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-12749 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: dbus, Ubuntu:16.04:LTS: dbus, Ubuntu:18.04:LTS: dbus</p> <p>dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: dbus, Ubuntu:16.04:LTS: dbus, Ubuntu:18.04:LTS: dbus</p> <p>dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-12749