Debian: DSA-2971-1 Critical: Dbus Access Errors And DoS Threats

CVE-2014-3477

Alban Crequy at Collabora Ltd. discovered that dbus-daemon sends an
AccessDenied error to the service instead of a client when the
client is prohibited from accessing the service. A local attacker
could use this flaw to cause a bus-activated service that is not
currently running to attempt to start, and fail, denying other users access to this service.

CVE-2014-3532

Alban Crequy at Collabora Ltd. discovered a bug in dbus-daemon's
support for file descriptor passing. A malicious process could force
system services or user applications to be disconnected from the
D-Bus system by sending them a message containing a file descriptor,
leading to a denial of service.

CVE-2014-3533

Alban Crequy at Collabora Ltd. and Alejandro Martinez Suarez
discovered that a malicious process could force services to be
disconnected from the D-Bus system by causing dbus-daemon to attempt
to forward invalid file descriptors to a victim process, leading to
...