[ GLSA 201706-05 ] D-Bus

[GLSA]

Gentoo Linux Security Advisory

Title: D-Bus: Multiple vulnerabilities (GLSA 201706-05)
Severity: normal
Exploitable: local, remote
Date: 2017-06-06
Bug(s): #611392
ID: 201706-05

Synopsis

Multiple vulnerabilities in D-Bus might allow an attacker to
overwrite files with a fixed filename in arbitrary directories or conduct a
symlink attack.


Background

D-Bus is a message bus system which processes can use to talk to each
other.


Affected Packages

Package: sys-apps/dbus
Vulnerable: < 1.10.18
Unaffected: >= 1.10.18
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in D-Bus. Please review
the original report referenced below for details.


Impact

An attacker could possibly overwrite arbitrary files named “once”
with content not controlled by the attacker.
A local attacker could perform a symlink attack against D-Bus’ test
suite.


Workaround

There is no known workaround at this time.

Resolution

All D-Bus users should upgrade to the latest version: