CVE catalog

CVE-2020-35512

dbus: CVE-2020-35512

[CVE catalog]

Severity
High · CVSS 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.33% · Oct 25, 2026

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandbussid1.16.2-8fixed
Debiandbusforky1.16.2-8fixed
Debiandbustrixie1.16.2-2fixed
Debiandbusbookworm1.14.10-1~deb12u1fixed
Ubuntudbuspro1.10.0-1ubuntu1vulnerable
Ubuntudbuspro1.10.4-1ubuntu2vulnerable
Ubuntudbuspro1.10.6-1ubuntu1vulnerable
Ubuntudbuspro1.10.6-1ubuntu2vulnerable
Ubuntudbuspro1.10.6-1ubuntu3vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.1vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.3vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.4vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.5vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.6vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.6+esm1fixed
Ubuntudbus18.041.10.22-1ubuntu1vulnerable
Ubuntudbus18.041.12.0-1ubuntu1vulnerable
Ubuntudbus18.041.12.2-1ubuntu1vulnerable
Ubuntudbus18.041.12.2-1ubuntu1.1vulnerable
Ubuntudbus18.041.12.2-1ubuntu1.2vulnerable
Ubuntudbus18.041.12.2-1ubuntu1.3fixed
Ubuntudbus20.041.12.14-1ubuntu2vulnerable
Ubuntudbus20.041.12.16-2ubuntu1vulnerable
Ubuntudbus20.041.12.16-2ubuntu2vulnerable
Ubuntudbus20.041.12.16-2ubuntu2.1vulnerable
Ubuntudbus20.041.12.16-2ubuntu2.2fixed
Ubuntudbuspro1.10.0-1ubuntu1vulnerable
Ubuntudbuspro1.10.4-1ubuntu2vulnerable
Ubuntudbuspro1.10.6-1ubuntu1vulnerable
Ubuntudbuspro1.10.6-1ubuntu2vulnerable
Ubuntudbuspro1.10.6-1ubuntu3vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.1vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.3vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.4vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.5vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.6vulnerable
Ubuntudbuspro1.10.6-1ubuntu3.6+esm1fixed
Ubuntudbus18.041.10.22-1ubuntu1vulnerable
Ubuntudbus18.041.12.0-1ubuntu1vulnerable
Ubuntudbus18.041.12.2-1ubuntu1vulnerable
Ubuntudbus18.041.12.2-1ubuntu1.1vulnerable
Ubuntudbus18.041.12.2-1ubuntu1.2vulnerable
Ubuntudbus18.041.12.2-1ubuntu1.3fixed
Ubuntudbus20.041.12.14-1ubuntu2vulnerable
Ubuntudbus20.041.12.16-2ubuntu1vulnerable
Ubuntudbus20.041.12.16-2ubuntu2vulnerable
Ubuntudbus20.041.12.16-2ubuntu2.1vulnerable
Ubuntudbus20.041.12.16-2ubuntu2.2fixed
Susedbus-1linux enterprise module for basesystem 15 sp21.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise module for basesystem 15 sp21.12.2-8.6.1fixed
Susedbus-1linux enterprise module for basesystem 15 sp31.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise module for basesystem 15 sp31.12.2-8.6.1fixed
Susedbus-1linux enterprise high performance computing 15 sp1-espos1.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise high performance computing 15 sp1-espos1.12.2-8.6.1fixed
Susedbus-1linux enterprise high performance computing 15 sp1-ltss1.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise high performance computing 15 sp1-ltss1.12.2-8.6.1fixed
Susedbus-1linux enterprise server 15 sp1-bcl1.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise server 15 sp1-bcl1.12.2-8.6.1fixed
Susedbus-1linux enterprise server 15 sp1-ltss1.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise server 15 sp1-ltss1.12.2-8.6.1fixed
Susedbus-1linux enterprise server for sap applications 15 sp11.12.2-8.6.1fixed
Susedbus-1-x11linux enterprise server for sap applications 15 sp11.12.2-8.6.1fixed
Susedbus-1manager proxy 4.01.12.2-8.6.1fixed
Susedbus-1-x11manager proxy 4.01.12.2-8.6.1fixed
Susedbus-1manager retail branch server 4.01.12.2-8.6.1fixed
Susedbus-1-x11manager retail branch server 4.01.12.2-8.6.1fixed
Susedbus-1manager server 4.01.12.2-8.6.1fixed
Susedbus-1-x11manager server 4.01.12.2-8.6.1fixed
Susedbus-1linux enterprise micro 5.01.12.2-8.6.1fixed
Susedbus-1enterprise storage 61.12.2-8.6.1fixed
Susedbus-1-x11enterprise storage 61.12.2-8.6.1fixed
Susedbus-1linux enterprise high performance computing 15-espos1.12.2-3.11.1fixed
Susedbus-1-x11linux enterprise high performance computing 15-espos1.12.2-3.11.1fixed
Susedbus-1linux enterprise high performance computing 15-ltss1.12.2-3.11.1fixed
Susedbus-1-x11linux enterprise high performance computing 15-ltss1.12.2-3.11.1fixed
Susedbus-1linux enterprise server 15-ltss1.12.2-3.11.1fixed
Susedbus-1-x11linux enterprise server 15-ltss1.12.2-3.11.1fixed
Susedbus-1linux enterprise server for sap applications 151.12.2-3.11.1fixed
Susedbus-1-x11linux enterprise server for sap applications 151.12.2-3.11.1fixed
Opensusedbus-1leap 15.31.12.2-8.6.1fixed
Opensusedbus-1-x11leap 15.31.12.2-8.6.1fixed
Susedbus-1linux enterprise server 12 sp2-bcl1.8.22-24.22.1fixed
Susedbus-1-x11linux enterprise server 12 sp2-bcl1.8.22-24.22.1fixed
Opensusedbus-1leap 15.21.12.2-lp152.6.3.1fixed
Opensusedbus-1-x11leap 15.21.12.2-lp152.6.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandbussourcesid1.12.20-1not yet assignedNot reportedNot reported
Debiandbussourceforky1.12.20-1not yet assignedNot reportedNot reported
Debiandbussourcetrixie1.12.20-1not yet assignedNot reportedNot reported
Debiandbussourcebookworm1.12.20-1not yet assignedNot reportedNot reported
Ubuntudbusdebpro1.10.6-1ubuntu3.6+esm1Not reportedUSN-5244-1Not reported
Ubuntudbusdeb18.041.12.2-1ubuntu1.3Not reportedUSN-5244-2Not reported
Ubuntudbusdeb20.041.12.16-2ubuntu2.2Not reportedUSN-5244-2Not reported
Ubuntudbusdebpro1.10.6-1ubuntu3.6+esm1Not reportedUBUNTU-CVE-2020-35512Not reported
Ubuntudbusdeb18.041.12.2-1ubuntu1.3Not reportedUBUNTU-CVE-2020-35512Not reported
Ubuntudbusdeb20.041.12.16-2ubuntu2.2Not reportedUBUNTU-CVE-2020-35512Not reported
Susedbus-1rpmlinux enterprise module for basesystem 15 sp21.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise module for basesystem 15 sp21.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise module for basesystem 15 sp31.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise module for basesystem 15 sp31.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise high performance computing 15 sp1-espos1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise high performance computing 15 sp1-espos1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise high performance computing 15 sp1-ltss1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise high performance computing 15 sp1-ltss1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise server 15 sp1-bcl1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise server 15 sp1-bcl1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise server 15 sp1-ltss1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise server 15 sp1-ltss1.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise server for sap applications 15 sp11.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmlinux enterprise server for sap applications 15 sp11.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmmanager proxy 4.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmmanager proxy 4.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmmanager retail branch server 4.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmmanager retail branch server 4.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmmanager server 4.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmmanager server 4.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise micro 5.01.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmenterprise storage 61.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1-x11rpmenterprise storage 61.12.2-8.6.1Not reportedSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise high performance computing 15-espos1.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1-x11rpmlinux enterprise high performance computing 15-espos1.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1rpmlinux enterprise high performance computing 15-ltss1.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1-x11rpmlinux enterprise high performance computing 15-ltss1.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1rpmlinux enterprise server 15-ltss1.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1-x11rpmlinux enterprise server 15-ltss1.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1rpmlinux enterprise server for sap applications 151.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Susedbus-1-x11rpmlinux enterprise server for sap applications 151.12.2-3.11.1Not reportedSUSE-SU-2021:2211-1Not reported
Opensusedbus-1rpmleap 15.31.12.2-8.6.1Not reportedOPENSUSE-SU-2021:2292-1Not reported
Opensusedbus-1-x11rpmleap 15.31.12.2-8.6.1Not reportedOPENSUSE-SU-2021:2292-1Not reported
Susedbus-1rpmlinux enterprise server 12 sp2-bcl1.8.22-24.22.1Not reportedSUSE-SU-2022:2788-1Not reported
Susedbus-1-x11rpmlinux enterprise server 12 sp2-bcl1.8.22-24.22.1Not reportedSUSE-SU-2022:2788-1Not reported
Opensusedbus-1rpmleap 15.21.12.2-lp152.6.3.1Not reportedOPENSUSE-SU-2021:1056-1Not reported
Opensusedbus-1-x11rpmleap 15.21.12.2-lp152.6.3.1Not reportedOPENSUSE-SU-2021:1056-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dbus]Fixed
    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-1-doc]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-bin]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-daemon]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-session-bus-common]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-system-bus-common]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · all · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-tests]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-user-session]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [dbus-x11]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [libdbus-1-3]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

  • [libdbus-1-dev]Fixed

    Source package: [dbus]

    Details (2)

    • 1.14.10-1~deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

    • 1.14.10-1~deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · bookworm; dsa · dbus · debian · 12

[Debian 13 (Trixie)]

  • [dbus]Fixed
    Details (2)

    • 1.16.2-2 · amd64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · arm64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-1-doc]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · all · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · all · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-bin]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · amd64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · arm64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-daemon]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · amd64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · arm64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-session-bus-common]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · all · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · all · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-system-bus-common]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · all · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · all · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-tests]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · amd64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · arm64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-user-session]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · amd64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · arm64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

  • [dbus-x11]Fixed

    Source package: [dbus]

    Details (2)

    • 1.16.2-2 · amd64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

    • 1.16.2-2 · arm64 · trixie

      Fixed · Fixed: 1.12.20-1

      dsa · dbus · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]