CVE-2014-3639: The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which a

Q: How do I fix CVE-2014-3639?

opensuse: mitigate or apply the listed mitigation; d-bus: upgrade to newer than 1.6.22; dbus: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Q: Is CVE-2014-3639 being exploited?

CVE-2014-3639 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2014-3639 affect?

CVE-2014-3639 affects opensuse, d-bus, dbus. Severity is low (CVSS 2.1). The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large n

Q: How urgent is CVE-2014-3639?

Priority 16/100. No elevated risk signals yet.

Routine

LOW 2.1MITIGATEUPGRADEMITIGATE

CVE-2014-3639 is a low-severity flaw (CVSS 2.1) affecting opensuse, d-bus, dbus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	2.1 (Low)
EPSS exploit chance	0.4% (top 65%)
CISA exploited list	No
Weakness	CWE-399
Published	2014-09-22
Last modified	2026-06-17

Publisher (CNA): Red Hat, Inc. · Vendor: d-bus project · freedesktop · opensuse

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-09-22 15:55 UTCPublished CVE record published
2026-06-17 00:08 UTCUpdated Record last modified

opensuse opensuse MITIGATE

Affected: 12.3

Fixed in: no fixed release known

Safe to downgrade to: a release before 12.3

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

d-bus project d-bus UPGRADE

Affected: <= 1.6.22

Fixed in: newer than 1.6.22

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy d-bus || rpm -q d-bus || d-bus --version

2. UPGRADE to newer than 1.6.22 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade d-bus

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade d-bus

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

freedesktop dbus MITIGATE

Affected: 1.6.0 · 1.6.2 · 1.6.4 · 1.6.6 · 1.6.8 · 1.6.10 · 1.6.12 · 1.6.14

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy dbus || rpm -q dbus || dbus --version

No fixed or unaffected release known

Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.

Downgrade not recommended

This is a core system component: downgrading can break the OS. Apply the distro update or the vendor mitigation.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-3639?

opensuse: mitigate or apply the listed mitigation; d-bus: upgrade to newer than 1.6.22; dbus: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2014-3639 being exploited?

CVE-2014-3639 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2014-3639 affect?

CVE-2014-3639 affects opensuse, d-bus, dbus. Severity is low (CVSS 2.1). The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large n

How urgent is CVE-2014-3639?

Priority 16/100. No elevated risk signals yet.

Related CVEs

CVE-2015-8126 HIGH 7.5 UPGRADE MITIGATE Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.
CVE-2015-7575 MEDIUM 5.9 UPGRADE MITIGATE Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ES
CVE-2012-5568 MEDIUM 5.0 UPGRADE MITIGATE Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial H
CVE-2016-9841 CRITICAL 9.8 UPGRADE MITIGATE inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impro
CVE-2016-9840 HIGH 8.8 UPGRADE UPGRADE inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging impr

References

← Back to latest CVEs