This was fixed by https://www.ubuntu.com/usn/usn-3116-1/
Thanks for the bug report!
** Changed in: dbus (Ubuntu)
Status: New => Fix Released
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to dbus in Ubuntu.
https://bugs.launchpad.net/bugs/1632239
Title:
dbus in Ubuntu has a format string vulnerability (fd.o #98157)
Status in dbus package in Ubuntu:
Fix Released
Bug description:
<http://www.openwall.com/lists/oss-security/2016/10/10/9>:
"""
Bug tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=98157
Versions affected: dbus >= 1.4.0
Mitigated in: dbus >= 1.9.10, 1.8.x >= 1.8.16, 1.6.x >= 1.6.30
Fixed in: dbus >= 1.11.6, 1.10.x >= 1.10.12, 1.8.x >= 1.8.22
Exploitable by: local users
Impact: unknown, possibly arbitrary code execution
Reporter: Simon McVittie, Collabora Ltd.
D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an
asynchronous inter-process communication system, commonly used
for system services or within a desktop session on Linux and other
operating systems.
A format string vulnerability in the reference bus implementation,
dbus-daemon, could potentially allow local users to cause arbitrary
code execution or denial of service.
In versions of dbus-daemon that are also vulnerable to CVE-2015-0245,
this format string vulnerability is available to all local users.
These versions should be patched or updated immediately.
"""
dbus in Ubuntu 12.04 LTS (precise), 14.04 LTS (trusty), 15.04 (vivid)
appears to be vulnerable to this, because CVE-2015-0245 was never
addressed in those suites.
Because the patch for this bug is so simple, I would also recommend
patching the suites that already have a fix for CVE-2015-0245, in case
we were wrong in our assessment of the security exposure.
In suites where you are willing to update to the current upstream
version from the same branch, please do so (that's what I have done in
Debian stable and unstable). For suites with tighter change-control,
there is a one-line patch on the oss-security advisory.
As D-Bus' de facto release manager, I aim to make stable branches
(x.y.z where y is an even number) suitable for use by change-averse
distributions like Debian stable. Debian 8 post-release updates
continue to follow the latest 1.8.x release. Please inform upstream if
there are changes going into stable branches that Ubuntu considers to
be excessive.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dbus/+bug/1632239/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
