High ALAS2-2019-1141 3 CVEs

Important: systemd security update (Amazon Linux 2)

Published Jan 7, 2019 · Updated Jan 9, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-16866: CVE-2018-16865: CVE-2018-16864:

Fixed packages 11

Release	Package	Fixed in
Amazon Linux · 2	libgudev1	0:219-57.amzn2.0.7
Amazon Linux · 2	libgudev1-devel	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-debuginfo	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-devel	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-journal-gateway	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-libs	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-networkd	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-python	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-resolved	0:219-57.amzn2.0.7
Amazon Linux · 2	systemd-sysv	0:219-57.amzn2.0.7

Vulnerabilities 3

High 7.5

CVE-2018-16865

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discove…

The systemd Project systemd systemd systemd Debian Ubuntu

Jan 11, 2019
High 7.4

CVE-2018-16864

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discove…

The systemd Project systemd systemd systemd Debian Ubuntu

Jan 11, 2019
Medium 4.3

CVE-2018-16866

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon …

The systemd Project systemd systemd systemd Debian Ubuntu

Jan 11, 2019

References

web
https://alas.aws.amazon.com/cve/html/CVE-2018-16864.html
web
https://alas.aws.amazon.com/cve/html/CVE-2018-16865.html
web
https://alas.aws.amazon.com/cve/html/CVE-2018-16866.html