CVE-2013-0292

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-03-05 · updated 2026-06-16
Weakness: CWE-20

Description

The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

Affected products

Freedesktop Dbus-Glib: through 0.100; 0.72, 0.73, 0.74, 0.76, 0.78, 0.80 (+9)

References

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658
http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://osvdb.org/90302
http://rhn.redhat.com/errata/RHSA-2013-0568.html
http://secunia.com/advisories/52225
http://secunia.com/advisories/52375
http://secunia.com/advisories/52404
http://www.exploit-db.com/exploits/33614
http://www.mandriva.com/security/advisories?name=MDVSA-2013:071
http://www.openwall.com/lists/oss-security/2013/02/15/10
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Get alerted when CVE-2013-0292 or the next vulnerability affects your stack