Homepage

Heap-based Buffer Overflow The advisory has been revoked - it doesn't affect any version of package dbus-devel  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS7-DBUSDEVEL-1939967
  • published26 Jul 2021
  • disclosed16 Sept 2014
Report a new vulnerability Found a mistake?

Introduced: 16 Sep 2014

CVE-2014-3635  (opens in a new tab)
CWE-122  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream dbus-devel package and not the dbus-devel package as distributed by Centos.

Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.