The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0335 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the dbus packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <=     1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the     same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap,     which is still used by data structures necessary for the other usernames sharing the UID, possibly leading     to a crash or other undefined behaviors (CVE-2020-35512)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0013 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-42010:
      An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures.

      CVE-2022-42011:
      An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.

      CVE-2022-42012:
      An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8977 advisory.

    D-Bus is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.

    Security Fix(es):

    * dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets     (CVE-2022-42010)

    * dbus: dbus-daemon can be crashed by messages with array length inconsistent with element type     (CVE-2022-42011)

    * dbus: `_dbus_marshal_byteswap` doesn't process fds in messages with foreign endianness correctly     (CVE-2022-42012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0096 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0335 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the dbus packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3804-1 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3805-1 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dbus package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
184914	Rocky Linux 9 : dbus (RLSA-2023:0335)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
177182	EulerOS Virtualization 3.0.6.0 : dbus (EulerOS-SA-2023-2208)	Nessus	Huawei Local Security Checks	2023/6/13	2023/6/13	high
238991	TencentOS Server 3: dbus (TSSA-2023:0013)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
168706	RHEL 9 : dbus (RHSA-2022:8977)	Nessus	Red Hat Local Security Checks	2022/12/13	2024/11/7	medium
170028	AlmaLinux 8 : dbus (ALSA-2023:0096)	Nessus	Alma Linux Local Security Checks	2023/1/13	2023/9/7	medium
170582	AlmaLinux 9 : dbus (ALSA-2023:0335)	Nessus	Alma Linux Local Security Checks	2023/1/25	2023/9/6	medium
176875	EulerOS Virtualization 2.11.1 : dbus (EulerOS-SA-2023-2034)	Nessus	Huawei Local Security Checks	2023/6/7	2023/6/7	medium
166689	SUSE SLES12 Security Update : dbus-1 (SUSE-SU-2022:3804-1)	Nessus	SuSE Local Security Checks	2022/10/28	2023/7/13	medium
166695	SUSE SLED15 / SLES15 Security Update : dbus-1 (SUSE-SU-2022:3805-1)	Nessus	SuSE Local Security Checks	2022/10/28	2023/7/13	medium
204091	Photon OS 3.0: Dbus PHSA-2022-3.0-0470	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium

检测

插件搜索

medium

high

medium

medium

medium

medium

medium

medium

medium

medium