Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. If the legitimate session party later authorizes execution, the root daemon may apply the attacker-chosen package operations.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-111253 Diğer
• github.com/…ommit/46a4a8ad8d34af91ec2add6bb29e487571ea6c85 Diğer

Kayıt geçmişi

1. 5 Kas 2026 19:30Yayımlandı

İlgili açıklar

• 8,1 CVE-2026-121997Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch
• 8,2 CVE-2026-121996Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length
• 7,5 CVE-2026-121995Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail
• 8,8 CVE-2026-121994Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length
• 3,7 CVE-2026-115456Gcc: out-of-bounds read in std::from_chars
• 6,5 CVE-2026-115455Gcc: stack overflow in std::bitset on libstdc++