The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3638