- Packages tracked
- 38,394
- Advisory records
- 728
- Fixed in fork
- 13
- Fixed upstream
- 8
- In flight
- 6
- Awaiting triage
- 700
- Awaiting approval
- 0
728 matching records
| CVE | Project | Title | Fork fix | State | Evidence | Discussion |
|---|---|---|---|---|---|---|
| DEBIAN-CVE-2024-52615 | debian/avahi | A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2024-52616 | debian/avahi | A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2025-59529 | debian/avahi | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc5, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2025-68276 | debian/avahi | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This c | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2025-68468 | debian/avahi | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they exp | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2025-68471 | debian/avahi | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2026-24401 | debian/avahi | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical n | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2026-34933 | debian/avahi | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-r | - | Awaiting triage | Evidence | None recorded |
| DLA-3047-1 | debian/avahi | avahi - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-3414-1 | debian/avahi | avahi - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-3466-1 | debian/avahi | avahi - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-3990-1 | debian/avahi | avahi - security update | - | Awaiting triage | Evidence | None recorded |
| DSA-1690-1 | debian/avahi | avahi - denial of service | - | Awaiting triage | Evidence | None recorded |
| DSA-2086-1 | debian/avahi | avahi - denial of service | - | Awaiting triage | Evidence | None recorded |
| DSA-2174-1 | debian/avahi | avahi - denial of service | - | Awaiting triage | Evidence | None recorded |
| DTSA-189-1 | debian/avahi | avahi - denial of service | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2005-0201 | debian/dbus | D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2006-6107 | debian/dbus | Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages). | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2008-0595 | debian/dbus | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2008-3834 | debian/dbus | The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2008-4311 | debian/dbus | The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_ | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2009-1189 | debian/dbus | The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2010-4352 | debian/dbus | Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2011-2200 | debian/dbus | The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive inf | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2011-2533 | debian/dbus | The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2012-3524 | debian/dbus | libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in th | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2013-2168 | debian/dbus | The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3477 | debian/dbus | The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3532 | debian/dbus | dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before t | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3533 | debian/dbus | dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3635 | debian/dbus | Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more f | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3636 | debian/dbus | D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3637 | debian/dbus | D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3638 | debian/dbus | The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-3639 | debian/dbus | The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2014-7824 | debian/dbus | D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix fo | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2015-0245 | debian/dbus | D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFai | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2019-12749 | debian/dbus | dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2020-12049 | debian/dbus | An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket cou | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2020-35512 | debian/dbus | A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2022-42010 | debian/dbus | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2022-42011 | debian/dbus | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2022-42012 | debian/dbus | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. | - | Awaiting triage | Evidence | None recorded |
| DEBIAN-CVE-2023-34969 | debian/dbus | D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon ca | - | Awaiting triage | Evidence | None recorded |
| DLA-1818-1 | debian/dbus | dbus - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-2235-1 | debian/dbus | dbus - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-3142-1 | debian/dbus | dbus - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-3628-1 | debian/dbus | dbus - security update | - | Awaiting triage | Evidence | None recorded |
| DLA-87-1 | debian/dbus | dbus - security update | - | Awaiting triage | Evidence | None recorded |
| DSA-1599-1 | debian/dbus | dbus | - | Awaiting triage | Evidence | None recorded |