id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
6132	dbus-1.8.16	bdubbs@…	Fernando de Oliveira	"New Point version

[http://dbus.freedesktop.org/releases/dbus/dbus-1.8.16.tar.gz]

[http://lists.freedesktop.org/archives/dbus/2015-February/016554.html]

{{{
...

This is a security update release for the current stable branch,
1.8.x. Please upgrade unless you have a reason to keep using an older
branch.

...

Security fixes:

• Do not allow non-uid-0 processes to send forged ActivationFailure
  messages. On Linux systems with systemd activation, this would
  allow a local denial of service: unprivileged processes could
  flood the bus with these forged messages, winning the race with
  the actual service activation and causing an error reply
  to be sent back when service auto-activation was requested.
  This does not prevent the real service from being started,
  so it only works while the real service is not running.
  (CVE-2015-0245, fd.o #88811; Simon McVittie)

...
}}}
"	enhancement	closed	normal	7.7	BOOK	SVN	medium	fixed