Description
A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| systemd | systemd | unspecified – ≤ 239 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | network-manager | 1.14.4-2 | — |
| Debian 14 | systemd | 239-11 | — |
| Debian 13 | network-manager | 1.14.4-2 | — |
| Debian 13 | systemd | 239-11 | — |
| Debian 12 | network-manager | 1.14.4-2 | — |
| Debian 12 | systemd | 239-11 | — |
| Debian 8 | systemd | 215-17+deb8u8 | DLA-1580-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | network-manager | 1.10.6-2ubuntu1.1 | USN-3807-1 |
| Ubuntu 18.04 LTS | systemd | 237-3ubuntu10.4 | USN-3806-1 |
| Ubuntu 16.04 LTS | network-manager | 1.2.6-0ubuntu0.16.04.3 | USN-3807-1 |
| Ubuntu 16.04 LTS | systemd | 229-4ubuntu21.6 | USN-3806-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | NetworkManager +14 | 1:1.12.0-8.el7_6 | RHSA-2018:3665 |
| RHEL 7 | systemd +9 | 219-62.el7_6.2 | RHSA-2019:0049 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | systemd | 234-24.15.1 | SUSE-SU-2018:3644-1 |
| SLES 12 SP4 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-2 |
| SLES 12 SP3 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-1 |
| SLES 12 SP2 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-2 |
| SLES for SAP 12 SP3 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-1 |
| SLES for SAP 12 SP2 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-1 |
| SUSE OpenStack Cloud 7 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-1 |
| SUSE Enterprise Storage 4 | systemd | 228-150.53.3 | SUSE-SU-2018:3767-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | NetworkManager | 1.32.10-2.1 | openSUSE-SU-2024:10602-1 |
| openSUSE Tumbleweed | systemd | 249.4-2.2 | openSUSE-SU-2024:11420-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | NetworkManager +13 | 1:1.12.0-8.amzn2.0.2 | ALAS2-2019-1144 |
| Amazon Linux 2 | systemd +9 | 219-57.amzn2.0.8 | ALAS2-2019-1160 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | NetworkManager +14 | 1:1.12.0-8.el7_6 | ELSA-2018-3665 |
| Oracle Linux 7 | systemd +9 | 219-62.0.4.el7_6.2 | ELSA-2019-0049 |
Advisories 15
- RHSA-2019:0049 Red Hat Security Advisory: systemd security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2018:3665 Red Hat Security Advisory: NetworkManager security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-3807-1 network-manager vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3806-1 systemd vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-1580-1 systemd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10602-1 NetworkManager-1.32.10-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3767-1 Security update for systemd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3767-2 Security update for systemd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11420-1 libsystemd0-249.4-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3644-1 Security update for systemd SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2019-1160 Important: systemd security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 23, 2025
- WID-SEC-2025-0391 systemd: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 17, 2025
- ELSA-2019-0049 Important: systemd security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 14, 2019
- ALAS2-2019-1144 Important: NetworkManager security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 9, 2019
- ELSA-2018-3665 Important: NetworkManager security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 27, 2018
References
- GLSA-201810-10 vendor-advisory
- [debian-lts-announce] 20181119 [SECURITY] [DLA 1580-1] systemd security update mailing-list
- USN-3807-1 vendor-advisory
- USN-3806-1 vendor-advisory
- RHSA-2018:3665 vendor-advisory
- 105745 vdb-entry
- https://github.com/systemd/systemd/pull/10518
- RHSA-2019:0049 vendor-advisory
- RHBA-2019:0327 vendor-advisory