CVE-2008-0595: Fedoraproject Fedora

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

Affected products

• Fedoraproject Fedora: version 7 only
• Freedesktop Dbus: before 1.0.3 (fixed in 1.0.3); from 1.1.0, before 1.1.20 (fixed in 1.1.20)
• Mandrakesoft Mandrake Linux: version 2007 only; version 2007.0_x86_64 only; version 2007.1 only; version 2008.0 only
• Red Hat Enterprise Linux: version 5 only; version 5.0 only

Published 2008-02-29. Last modified 2026-06-16.