JLSEC-2025-18

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-18.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-18.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2025-18

Upstream

CVE-2020-12049

Published

2025-10-10T14:27:45.619Z

Modified

2025-11-03T00:18:43.256101Z

Summary

An issue was discovered in dbus >= 1.3.0 before 1.12.18

Details

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "id": "CVE-2020-12049",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-12049",
            "published": "2020-06-08T17:15:09.910Z",
            "imported": "2025-10-10T13:32:21.997Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12049",
            "modified": "2024-11-21T04:59:10.813Z"
        }
    ]
}

References

Affected packages

Julia / Dbus_jll

Package

Name: Dbus_jll
Purl: pkg:julia/Dbus_jll?uuid=ee1fde0b-3d02-5ea6-8484-8dfef6360eab

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.14.10+0