6.9

CVE-2012-3524: freedesktop libdbus

CVSS: 6.9v2.0MediumModified
AliasesRHSA-2012:1261DEBIAN-CVE-2012-3524
Published 18-09-2012Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2012-3524 is a medium (CVSS 6.9) vulnerability in freedesktop libdbus. EPSS estimates a 4.48% chance of exploitation in the next 30 days, higher than 91.3% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
38/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.9/10
010
Medium · v2.0 (NVD)
EPSS score
4.48%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10517-1

Timeline

  1. 18-09-2012
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

4.48%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.48% on 20-09-2026

20-09-202620-10-2026
EPSS score
4.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (securityfocus.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (stealth.openwall.net)

    Maturity: unknown

  • exploit-databaselocallinuxUnverified

    libdbus - 'DBUS_SYSTEM_BUS_ADDRESS' Local Privilege Escalation

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat6 products
  • dbus< 1:1.2.24-7.el6_3
  • dbus-debuginfo< 1:1.2.24-7.el6_3
  • dbus-devel< 1:1.2.24-7.el6_3
  • dbus-doc< 1:1.2.24-7.el6_3
  • dbus-libs< 1:1.2.24-7.el6_3
Debian2 products
  • dbus< 1.6.8-1
  • glib2.0< 2.33.12+really2.32.4-2
Freedesktop1 product
  • libdbus≤ 1.5.12 | 1.5.0 | 1.5.2 | 1.5.4 | 1.5.6 | 1.5.8 | 1.5.10

3 vendors · 9 products

References

30 links
Show all 30 references