CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 3CVE-2019-3842 – systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit
https://notcve.org/view.php?id=CVE-2019-3842
09 Apr 2019 — In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any". En systemd anterior de la versión v242-rc4, fue encontrado que pam_systemd no sanea apropiadamente el entorno anterior usando la variable XDG_... • https://packetstorm.news/files/id/152610 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 4.7EPSS: 0%CPEs: 7EXPL: 0CVE-2018-16888 – systemd: kills privileged process if unprivileged PIDFile was tampered
https://notcve.org/view.php?id=CVE-2018-16888
14 Jan 2019 — It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable. Se ha descubierto que systemd no comprueba correctamente el contenido de archivos PIDFile antes de ... • https://access.redhat.com/errata/RHSA-2019:2091 • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 2CVE-2018-16865 – systemd: stack overflow when receiving many journald entries
https://notcve.org/view.php?id=CVE-2018-16865
09 Jan 2019 — An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable. Se ha descubierto una asignación de memoria sin límites que podría resultar en que la pila choque con otra región de memoria, ... • https://packetstorm.news/files/id/152841 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 23EXPL: 1CVE-2018-16864 – systemd: stack overflow when calling syslog from a command with long cmdline
https://notcve.org/view.php?id=CVE-2018-16864
09 Jan 2019 — An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable. Se ha descubierto una asignación de memoria sin límites, que podría resultar en que la pila choque con otra región de memoria, en systemd-journald, cuando un programa con argumento... • http://www.openwall.com/lists/oss-security/2021/07/20/2 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2018-15688 – Out-of-Bounds write in systemd-networkd dhcpv6 option handling
https://notcve.org/view.php?id=CVE-2018-15688
26 Oct 2018 — A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239. Una vulnerabilidad de desbordamiento de búfer en el cliente dhcp6 de systemd permite que un servidor dhcp6 malicioso sobrescriba memoria dinámica (heap) en systemd-networkd. Las versiones afectadas de systemd son todas hasta la 239 incluida. It was discovered that systemd-network does not correctly keep t... • http://www.securityfocus.com/bid/105745 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 3CVE-2018-15686 – systemd: reexec state injection: fgets() on overlong lines leads to line splitting
https://notcve.org/view.php?id=CVE-2018-15686
26 Oct 2018 — A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239. Una vulnerabilidad en unit_deserialize de systemd permite que un atacante proporcione estados arbitrarios en la reejecución de systemd mediante NotifyAccess. Esto puede emplearse para influenciar incorre... • https://packetstorm.news/files/id/149972 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2018-6954 – Ubuntu Security Notice USN-3816-3
https://notcve.org/view.php?id=CVE-2018-6954
13 Feb 2018 — systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on. systemd-tmpfiles en systemd, hasta 237, gestiona de manera incorrecta los vínculos simbólicos presentes en componentes de ruta no terminales. Esto per... • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.9EPSS: 2%CPEs: 17EXPL: 0CVE-2018-1049 – systemd: automount: access to automounted volumes can lock up
https://notcve.org/view.php?id=CVE-2018-1049
31 Jan 2018 — In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted. En systemd en versiones anteriores a la 234, existe una condición de carrera entre las unidades .mount y .automount, de forma que las peticiones automount del kernel... • http://www.securitytracker.com/id/1041520 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 5CVE-2017-18078 – systemd (systemd-tmpfiles) < 236 - 'fs.protected_hardlinks=0' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-18078
29 Jan 2018 — systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file. systemd-tmpfiles en systemd en versiones anteriores a la 237 intenta soportar cambios de propiedad/permisos en archivos con vínculos ... • https://packetstorm.news/files/id/146184 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000082
https://notcve.org/view.php?id=CVE-2017-1000082
07 Jul 2017 — systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended. systemd versión v233 y anteriores, no pueden analizar de forma segura los nombres de usuario que comienzan con un dígito numérico (por ejemplo, ""0day""), ejecutando el servicio en cuestión con privilegios root en lugar de lo que el usuario desea. • http://www.openwall.com/lists/oss-security/2017/07/02/1 • CWE-269: Improper Privilege Management •