CVE-2014-8156

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git (fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged) git master on 2015-01-19, the upstream framework.git 0.10.1 and git master on 2015-01-19, phonefsod 0.1+git20121018-1 as packaged in Debian, Ubuntu and potentially other packages, and potentially other fso modules do not properly filter D-Bus message paths, which might allow local users to cause a denial of service (dbus-daemon memory consumption), or execute arbitrary code as root by sending a crafted D-Bus message to any D-Bus system service.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/01/27/25Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72363Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100488Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2015/01/27/25Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72363Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100488Third Party Advisory, VDB Entry

Timeline

Published: Sep 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-81577.5Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (cra CVE-2014-81586.8Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash CVE-2014-81596.9The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly CVE-2014-81605.0net/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain CVE-2014-81614.3PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated u CVE-2014-81627.5XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to r CVE-2014-81636.5Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.CVE-2014-81649.1A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red CVE-2014-816510.0scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote attackers to execute CVE-2014-81668.8The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attacke CVE-2014-81675.9vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack CVE-2014-81686.1Red Hat Satellite 6 allows local users to access mongod and delete pulp_database.