CVE-2020-35512 (GCVE-0-2020-35512)

Vulnerability from cvelistv5 – Published: 2021-02-15 16:08 – Updated: 2024-11-19 15:32
VLAI?
Summary
A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
Severity ?
No CVSS data available.
CWE
  • Use-After-Free
Assigner
References
Impacted products
Vendor Product Version
n/a D-Bus Development branch Affected: <= 1.13.16 (Fixed: >= 1.13.18)
    n/a dbus-1.12.x stable branch Affected: <= 1.12.18 (Fixed: >= 1.12.20)
    n/a dbus-1.10.x and older branches (EOL) Affected: <= 1.10.30 (Fixed: 1.10.32)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:02:08.036Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.gentoo.org/755392"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-35512",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-19T15:31:25.634957Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-19T15:32:44.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "D-Bus Development branch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.13.16 (Fixed: \u003e= 1.13.18)"
            }
          ]
        },
        {
          "product": "dbus-1.12.x stable branch",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.12.18 (Fixed: \u003e= 1.12.20)"
            }
          ]
        },
        {
          "product": "dbus-1.10.x and older branches (EOL)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.10.30 (Fixed: 1.10.32)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-After-Free",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-08T20:46:11",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.gentoo.org/755392"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-35512",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "D-Bus Development branch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 1.13.16 (Fixed: \u003e= 1.13.18)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "dbus-1.12.x stable branch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 1.12.18 (Fixed: \u003e= 1.12.20)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "dbus-1.10.x and older branches (EOL)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 1.10.30 (Fixed: 1.10.32)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use-After-Free"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.gentoo.org/755392",
              "refsource": "MISC",
              "url": "https://bugs.gentoo.org/755392"
            },
            {
              "name": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128",
              "refsource": "MISC",
              "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2020-35512",
              "refsource": "MISC",
              "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-35512",
    "datePublished": "2021-02-15T16:08:39",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-11-19T15:32:44.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:freedesktop:dbus:1.12.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D03731AA-A978-47F1-AE31-4873554468E8\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 un fallo de uso de la memoria previamente liberada D-Bus rama de desarrollo versiones iguales o anteriores a 1.13.16, dbus-1.12.x rama estable versiones iguales o anteriores a 1.12.18, y dbus-1.10.x y ramas anteriores versiones iguales o anteriores a 1.10.30 cuando un sistema tiene m\\u00faltiples nombres de usuario que comparten el mismo UID. Cuando un conjunto de reglas de pol\\u00edtica hace referencia a estos nombres de usuario, D-Bus puede liberar algo de memoria en la pila, que sigue siendo utilizada por las estructuras de datos necesarias para los otros nombres de usuario que comparten el UID, lo que puede provocar un fallo u otros comportamientos indefinidos\"}]",
      "id": "CVE-2020-35512",
      "lastModified": "2024-11-21T05:27:28.203",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 7.2, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 3.9, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2021-02-15T17:15:12.993",
      "references": "[{\"url\": \"https://bugs.gentoo.org/755392\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2020-35512\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugs.gentoo.org/755392\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2020-35512\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-35512\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2021-02-15T17:15:12.993\",\"lastModified\":\"2024-11-21T05:27:28.203\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un fallo de uso de la memoria previamente liberada D-Bus rama de desarrollo versiones iguales o anteriores a 1.13.16, dbus-1.12.x rama estable versiones iguales o anteriores a 1.12.18, y dbus-1.10.x y ramas anteriores versiones iguales o anteriores a 1.10.30 cuando un sistema tiene m\u00faltiples nombres de usuario que comparten el mismo UID. Cuando un conjunto de reglas de pol\u00edtica hace referencia a estos nombres de usuario, D-Bus puede liberar algo de memoria en la pila, que sigue siendo utilizada por las estructuras de datos necesarias para los otros nombres de usuario que comparten el UID, lo que puede provocar un fallo u otros comportamientos indefinidos\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":7.2,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":3.9,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:freedesktop:dbus:1.12.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D03731AA-A978-47F1-AE31-4873554468E8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1\"}]}]}],\"references\":[{\"url\":\"https://bugs.gentoo.org/755392\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://security-tracker.debian.org/tracker/CVE-2020-35512\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugs.gentoo.org/755392\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security-tracker.debian.org/tracker/CVE-2020-35512\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://bugs.gentoo.org/755392\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2020-35512\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T17:02:08.036Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2020-35512\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-19T15:31:25.634957Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-19T15:32:39.731Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"D-Bus Development branch\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 1.13.16 (Fixed: \u003e= 1.13.18)\"}]}, {\"vendor\": \"n/a\", \"product\": \"dbus-1.12.x stable branch\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 1.12.18 (Fixed: \u003e= 1.12.20)\"}]}, {\"vendor\": \"n/a\", \"product\": \"dbus-1.10.x and older branches (EOL)\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 1.10.30 (Fixed: 1.10.32)\"}]}], \"references\": [{\"url\": \"https://bugs.gentoo.org/755392\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2020-35512\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Use-After-Free\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2021-03-08T20:46:11\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"\u003c= 1.13.16 (Fixed: \u003e= 1.13.18)\"}]}, \"product_name\": \"D-Bus Development branch\"}, {\"version\": {\"version_data\": [{\"version_value\": \"\u003c= 1.12.18 (Fixed: \u003e= 1.12.20)\"}]}, \"product_name\": \"dbus-1.12.x stable branch\"}, {\"version\": {\"version_data\": [{\"version_value\": \"\u003c= 1.10.30 (Fixed: 1.10.32)\"}]}, \"product_name\": \"dbus-1.10.x and older branches (EOL)\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://bugs.gentoo.org/755392\", \"name\": \"https://bugs.gentoo.org/755392\", \"refsource\": \"MISC\"}, {\"url\": \"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\", \"name\": \"https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128\", \"refsource\": \"MISC\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\", \"name\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1909101\", \"refsource\": \"MISC\"}, {\"url\": \"https://security-tracker.debian.org/tracker/CVE-2020-35512\", \"name\": \"https://security-tracker.debian.org/tracker/CVE-2020-35512\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A use-after-free flaw was found in D-Bus Development branch \u003c= 1.13.16, dbus-1.12.x stable branch \u003c= 1.12.18, and dbus-1.10.x and older branches \u003c= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Use-After-Free\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2020-35512\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"secalert@redhat.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2020-35512\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-19T15:32:44.371Z\", \"dateReserved\": \"2020-12-17T00:00:00\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2021-02-15T16:08:39\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.