-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Package : dbus Version : 1.8.22-0+deb8u2 CVE ID : CVE-2019-12749 Debian Bug : 930375
Joe Vennix discovered an authentication bypass vulnerability in dbus, an asynchronous inter-process communication system. The implementation of the DBUS_COOKIE_SHA1 authentication mechanism was susceptible to a symbolic link attack. A local attacker could take advantage of this flaw to bypass authentication and connect to a DBusServer with elevated privileges. For Debian 8 "Jessie", this problem has been fixed in version 1.8.22-0+deb8u2. We recommend that you upgrade your dbus packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAl0DiwIACgkQnUbEiOQ2 gwLZDxAAtmfjDVtOAytK5QN6A1CsnufwNzBDnBNVlKqpig04LsU6+x+qCQG7BlJ0 cgpjsAvnlXbV6+JJivzm75KVbVhOqKB5A1EjNB77F7clrPSkiMipPYntn8NzweE3 Q+n+7ICF6cYm/DAY1aRxzdJyUW/syD/cuFWgHoEdkyksXKF0nDqQsXzK0YW+W9o3 nkJiwFrfKmxfXPJf07PupUv/XeRONBds72jQE+RcAgdHTebr34+W5TvD1p9nCq2e tl1O6tyW/K7Rs4HJKVQVxPk7mRLfhPdJh85eef0m44KVsfHEhQRykKJ+0gCROlp+ 44AUb5PBJVoSwEM1UpcKsxFVuCmGZ1WL7TQl4z/T1b56CjOfnYp1++jRFoIrP5Ic evsHBm7fwN7Ogtu4TCgFKiekIx4ByoUcwcE958hn9gBlnYUv/wPA4/6zdgVQsxGA utvYGByDwJr3odAwUp9Gzq1XHH0++CrPoxye3F8811lspwE8LVSGDe8dBGVr3lJx AakIKBrn21oxeTUUZlOOUOhD5sIccbiTXN3xPWUN0unTlOdY17D69Sp4wSMpHRDY UYPxppFT5F4L1dgbO2Q4aaMANJxuEXRFuRG9i+zOmkVvaEk/TV7AgeMioqpwhfZj gjSWwqpJM1LefW6+ceg4rQgL+Nk71mtCOTkeBlPzsxQdp8TpGYk= =7qgA -----END PGP SIGNATURE-----
