dbus-1.14.8

[Xi Ruoyao]

New patch version.

[Xi Ruoyao]

Denial-of-service fixes:

• Fix an assertion failure in dbus-daemon when a privileged Monitoring connection (dbus-monitor, busctl monitor, gdbus monitor or similar) is active, and a message from the bus driver cannot be delivered to a client connection due to <deny> rules or outgoing message quota. This is a denial of service if triggered maliciously by a local attacker. (dbus#457; hongjinghao, Simon McVittie)

Other fixes:

• Fix compilation on compilers not supporting __FUNCTION__ (dbus!404, Barnabás Pőcze)

• Fix some memory leaks on out-of-memory conditions (dbus!403, Barnabás Pőcze)

• Documentation: · Fix syntax of a code sample in dbus-api-design

(dbus!396; Yen-Chin, Lee)

Tests and CI enhancements:

• Fix CI pipelines after freedesktop/freedesktop#540 (dbus!405, dbus#456; Simon McVittie)

[Xi Ruoyao]

Security+ as the upstream is assigning a CVE number.

[Xi Ruoyao]

Replying to Xi Ruoyao:

Security+ as the upstream is assigning a CVE number.

Now assigned CVE-2023-34969 for the denial-of-service.

[Bruce Dubbs]

Fixed at commit 2ebf4143a8e1dfac1f4855ae116aeabb3f50418a

[Douglas R. Reno]

SA-11.3-041 issued

[Bruce Dubbs]

Milestone renamed