CVE-2019-15718
An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
Does this matter?
Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.
Description
In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
- CVSS 3.1
- 4.4 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.51% probability · 43th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- systemd project/systemd · fedoraproject/fedora · redhat/openshift container platform · redhat/enterprise linux · redhat/enterprise linux eus · redhat/enterprise linux for ibm z systems 8 s390x · redhat/enterprise linux for ibm z systems eus · redhat/enterprise linux for ibm z systems eus s390x · redhat/enterprise linux for power little endian · redhat/enterprise linux for power little endian eus · redhat/enterprise linux server aus · redhat/enterprise linux server for power little endian update services for sap solutions · redhat/enterprise linux server tus · redhat/enterprise linux server update services for sap solutions
- Source
- cve@mitre.org
EPSS 0.5% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.openwall.com/lists/oss-security/2019/09/03/1Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3592Issue Tracking, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3941Issue Tracking, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1746057Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRE5IS24XTF5WNZGH2L7GSQJKARBOEGL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIKGKXZ5OEGOEYURHLJHEMFYNLEGAW5B/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2WNHRJW4XI6H5YMDG4BUFGPAXWUMUVG/
- http://www.openwall.com/lists/oss-security/2019/09/03/1Exploit, Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3592Issue Tracking, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3941Issue Tracking, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1746057Issue Tracking, Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRE5IS24XTF5WNZGH2L7GSQJKARBOEGL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIKGKXZ5OEGOEYURHLJHEMFYNLEGAW5B/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2WNHRJW4XI6H5YMDG4BUFGPAXWUMUVG/
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.