$ cve CVE-2012-3524 JSON

CVE-2012-3524 EXPLOIT

6.9

MEDIUM · CVSS 2.0 · EPSS 4.5% (pctl 91)

Patch early

A public exploit exists.

Description

libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."

Scoring

CVSS	6.9 (MEDIUM, v2.0)
Vector	AV:L/AC:M/Au:N/C:C/I:C/A:C
EPSS	4.48% — more likely to be exploited than 91% of all CVEs
Weakness	CWE-264
On CISA KEV	no
Public exploit	yes
Published	2012-09-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
freedesktop	libdbus

Public exploits

Source	Title	Date
exploit-db	libdbus - 'DBUS_SYSTEM_BUS_ADDRESS' Local Privilege Escalation	2012-07-17

References

→ the Explorer · watch your stack · NVD