Debian Long Term Support / LTS Security Information / 2019 / Security Information -- DLA-1639-1 systemd

Debian Security Advisory

DLA-1639-1 systemd -- LTS security update

Date Reported:

23 Jan 2019

Affected Packages:

systemd

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 918841, Bug 918848.
In Mitre's CVE dictionary: CVE-2018-16864, CVE-2018-16865.

More information:

Multiple vulnerabilities were found in the journald component of systemd which can lead to a crash or code execution.

• CVE-2018-16864

  An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges.

• CVE-2018-16865

  An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

For Debian 8 Jessie, these problems have been fixed in version 215-17+deb8u9.

We recommend that you upgrade your systemd packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS