ALT Linux Team

Package systemd update in c8.1 on 2019-06-24

ALT-PU-2019-2138-1

Package systemd updated to version 239-alt3.M80P.1 for branch c8.1 in task 231703.

Closed vulnerabilities

Published: 2019-01-11

BDU:2019-00412

Уязвимость в бинарной системе хранения служебной информации systemd-journald операционной системы Debian, позволяющая нарушителю вызвать отказ в обслуживании или повысить привилегии в системе

Severity: HIGH (7.0) Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM (6.2) Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
References:
Published: 2019-01-11

BDU:2019-00413

Уязвимость в бинарной системе хранения служебной информации systemd-journald операционной системы Debian, позволяющая нарушителю вызвать отказ в обслуживании или повысить привилегии в системе

Severity: HIGH (7.5) Vector: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH (7.6) Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
References:
Published: 2019-01-11

BDU:2019-00414

Уязвимость в бинарной системе хранения служебной информации systemd-journald операционной системы Debian, позволяющая нарушителю получить доступ к конфиденциальным данным

Severity: MEDIUM (4.3) Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: LOW (3.3) Vector: AV:A/AC:L/Au:N/C:P/I:N/A:N
References:
Published: 2019-01-17

BDU:2019-01413

Уязвимость функции bus_process_object() подсистемы инициализации операционных систем Linux Systemd, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM (4.9) Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
References:
Published: 2018-11-27

BDU:2019-01751

(ДУБЛИКАТ)Уязвимость бинарной системы хранения служебной информации systemd-journald, вызванная выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании или выполнить код с привилегиями journald

Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH (7.2) Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2018-11-27

BDU:2019-01752

(ДУБЛИКАТ)Уязвимость бинарной системы хранения служебной информации systemd-journald, вызванная выходом операции за границы буфера в памяти, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании

Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH (7.2) Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2018-01-24

BDU:2019-02469

Уязвимость компонента systemd-tmpfiles демона Systemd, позволяющая нарушителю получить доступ к произвольным файлам

Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH (7.2) Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2013-10-28
Modified: 2025-06-09

CVE-2013-4392

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

Severity: LOW (3.3) Vector: AV:L/AC:M/Au:N/C:P/I:P/A:N
Severity: MEDIUM (5.0) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References:
Published: 2019-01-11
Modified: 2024-11-21

CVE-2018-16864

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

Severity: MEDIUM (4.6) Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2019-01-11
Modified: 2024-11-21

CVE-2018-16865

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

Severity: MEDIUM (4.6) Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2019-01-11
Modified: 2024-11-21

CVE-2018-16866

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

Severity: LOW (2.1) Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N
Severity: LOW (3.3) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References:
Published: 2018-02-13
Modified: 2025-06-09

CVE-2018-6954

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Severity: HIGH (7.2) Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2019-03-21
Modified: 2024-11-21

CVE-2019-6454

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

Severity: MEDIUM (4.9) Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C
Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:

Closed bugs

Bug #36267

нужна явная зависимость от systemd

VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.2
Back to top