An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dbus-broker | Dbus-broker_project | * | 31 (excluding) |
| Red Hat Enterprise Linux 9 | RedHat | dbus-broker-0:28-5.1.el9_0 | * |
| Dbus-broker | Ubuntu | esm-apps/jammy | * |
| Dbus-broker | Ubuntu | impish | * |
| Dbus-broker | Ubuntu | jammy | * |
| Dbus-broker | Ubuntu | upstream | * |
Potential Mitigations
References
- https://github.com/bus1/dbus-broker/compare/v30...v31
- https://sec-consult.com/vulnerability-lab/advisory/memory-corruption-vulnerabilities-dbus-broker/
- https://security.gentoo.org/glsa/202305-04
- https://github.com/bus1/dbus-broker/compare/v30...v31
- https://sec-consult.com/vulnerability-lab/advisory/memory-corruption-vulnerabilities-dbus-broker/
- https://security.gentoo.org/glsa/202305-04