Lucene search

K
suseSuseOPENSUSE-SU-2018:3803-1
HistoryNov 17, 2018 - 12:16 a.m.

Security update for systemd (important)

2018-11-1700:16:31
lists.opensuse.org
354

0.003 Low

EPSS

Percentile

65.4%

This update for systemd fixes the following issues:

Security issues fixed:

  • CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of
    systemd allowed a malicious dhcp6 server to overwrite heap memory in
    systemd-networkd. (bsc#1113632)
  • CVE-2018-15686: A vulnerability in unit_deserialize of systemd allows an
    attacker to supply arbitrary state across systemd re-execution via
    NotifyAccess. This can be used to improperly influence systemd execution
    and possibly lead to root privilege escalation. (bsc#1113665)

Non-security issues fixed:

  • dhcp6: split assert_return() to be more debuggable when hit

  • core: skip unit deserialization and move to the next one when
    unit_deserialize() fails

  • core: properly handle deserialization of unknown unit types (#6476)

  • core: don’t create Requires for workdir if "missing ok" (bsc#1113083)

  • logind: use manager_get_user_by_pid() where appropriate

  • logind: rework manager_get_{user|session}_by_pid() a bit

  • login: fix [email protected] case, so we don’t allow nested sessions (#8051)
    (bsc#1112024)

  • core: be more defensive if we can’t determine per-connection socket peer
    (#7329)

  • socket-util: introduce port argument in sockaddr_port()

  • service: fixup ExecStop for socket-activated shutdown (#4120)

  • service: Continue shutdown on socket activated unit on termination
    (#4108) (bsc#1106923)

  • cryptsetup: build fixes for "add support for sector-size= option"

  • udev-rules: IMPORT cmdline does not recognize keys with similar names
    (bsc#1111278)

  • core: keep the kernel coredump defaults when systemd-coredump is disabled

  • core: shorten main() a bit, split out coredump initialization

  • core: set RLIMIT_CORE to unlimited by default (bsc#1108835)

  • core/mount: fstype may be NULL

  • journald: don’t ship systemd-journald-audit.socket (bsc#1109252)

  • core: make "tmpfs" dependencies on swapfs a "default" dep, not an
    "implicit" (bsc#1110445)

  • mount: make sure we unmount tmpfs mounts before we deactivate swaps
    (#7076)

  • tmp.mount.hm4: After swap.target (#3087)

  • Ship systemd-sysv-install helper via the main package This script was
    part of systemd-sysvinit sub-package but it was wrong since
    systemd-sysv-install is a script used to redirect enable/disable
    operations to chkconfig when the unit targets are sysv init scripts.
    Therefore it’s never been a SySV init tool.

This update was imported from the SUSE:SLE-12-SP2:Update update project.