63 results · Feed
-
High 7.8CVE-2018-15687 Public exploit
systemd: chown_one() can dereference symlinks
A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
-
High 7.0CVE-2018-15686 Public exploit
systemd: reexec state injection: fgets() on overlong lines leads to line splitting
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected relea…
-
High 8.8
Out-of-Bounds write in systemd-networkd dhcpv6 option handling
A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
-
Unscored —CVE-2018-1049 Public exploit
In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from k…
-
High 7.8
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local…
-
Unscored —CVE-2017-18078 Public exploit
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the…
-
Unscored —CVE-2017-15908 EPSS 24%
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger a…
-
Unscored —
Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
-
Unscored —
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the servi…
-
Unscored —CVE-2017-9445 EPSS 59%
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer th…
-
Unscored —CVE-2017-9217 EPSS 16%
systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS resp…
-
Unscored —CVE-2016-10156 Public exploit
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd ti…
-
Unscored —
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a …
-
Unscored —
The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (…
-
Unscored —
tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allow…
-
Unscored —
tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and…
-
Unscored —
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, a…
-
Medium 5.0
systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for…
-
Unscored —
journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service…
-
Unscored —
Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to ca…
-
Unscored —
The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions o…
-
Unscored —
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass inten…
-
Unscored —
The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allow…