CVE-2019-15718: fedoraproject fedora
Vulnerability summary
CVE-2019-15718 is a medium (CVSS 4.4) vulnerability in fedoraproject fedora. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat27 products
- enterprise_linux8.0
- enterprise_linux_eus8.1 | 8.2 | 8.4
- enterprise_linux_for_ibm_z_systems_eus8.1 | 8.2 | 8.4
- enterprise_linux_for_ibm_z_systems_eus_s390x8.1 | 8.2
- enterprise_linux_for_power_little_endian8.0
Debian1 product
- systemd< 242-7
Fedoraproject1 product
- fedoraEOL29 | 30 | 31
Mageia1 product
- systemd< 241-8.4.mga7
Systemd_project1 product
- systemd240
Ubuntu1 product
- systemd< 237-3ubuntu10.28
6 vendors · 32 products
References
37 links- bugzilla.redhat.com/show_bug.cgi?id=1746057X Refsource MISCIssue TrackingPatchThird Party AdvisoryREPORT
- www.openwall.com/lists/oss-security/2019/09/03/1X Refsource MISCExploitMailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3592Vendor AdvisoryX Refsource REDHATIssue TrackingThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2019:3941Vendor AdvisoryX Refsource REDHATIssue TrackingPatchThird Party Advisory
