Red Hat Security Advisory: systemd security, bug fix, and enhancement update

Fixed packages 44

Vulnerabilities 3

• High 7.0
  CVE-2018-15686 Public exploit

  systemd: reexec state injection: fgets() on overlong lines leads to line splitting

  A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected relea…

  systemd systemd systemd systemd Debian Ubuntu
  Oct 26, 2018
• Medium 4.4
  CVE-2018-16888

  It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When…

  The systemd Project systemd systemd systemd Debian Ubuntu
  Jan 14, 2019
• Medium 4.3
  CVE-2018-16866

  An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon …

  The systemd Project systemd systemd systemd Debian Ubuntu
  Jan 11, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1267552
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1272485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1463678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1585913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1619543
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1631625
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1639071
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1641764
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1643172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1651257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1653867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1660422
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1662867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1663365
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1666612
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1691511
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1693559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1693716
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1697909
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2091.json
• report
  https://access.redhat.com/security/cve/CVE-2018-15686
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-15686
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-15686
• report
  https://access.redhat.com/security/cve/CVE-2018-16866
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16866
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16866
• article
  https://www.qualys.com/2019/01/09/system-down/system-down.txt
• report
  https://access.redhat.com/security/cve/CVE-2018-16888
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16888
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16888