| Package | Affected versions | Patched versions |
|---|---|---|
| dbus | ≥ 1.1.0, < 1.1.20< 1.0.3 | 1.1.201.0.3 |
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free