What is the CVSS score of CVE-2014-3635?

CVE-2014-3635 has a CVSS 2.0 base score of 4.4 (Medium). CVSS vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2014-3635?

Yes, a patch is available for CVE-2014-3635. Update the affected software to the latest version immediately.

D Bus CVE-2014-3635

MEDIUM

Buffer Overflow (CWE-119)

2014-09-22 secalert@redhat.com

Denial Of Service RCE Buffer Overflow D Bus Dbus Opensuse

4.4

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:L/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:P/I:P/A:P

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Sep 22, 2014 - 15:55 cve.org

MEDIUM 4.4

DescriptionCVE.org

Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.

AnalysisAI

Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to. Rated medium severity (CVSS 4.4). This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

Technical ContextAI

This vulnerability is classified as Buffer Overflow (CWE-119), which allows attackers to corrupt memory to execute arbitrary code or crash the application. Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure. Affected products include: D-Bus Project D-Bus, Freedesktop Dbus, Opensuse. Version information: through 1.6..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use memory-safe languages or bounds-checking. Enable ASLR, DEP/NX, stack canaries. Use safe string functions.