rpm package
suse/systemd&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1
pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-1712 | — | < 234-24.46.1 | 234-24.46.1 | Mar 31, 2020 | A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate thei | ||
| CVE-2019-20386 | — | < 234-24.39.1 | 234-24.39.1 | Jan 21, 2020 | An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. | ||
| CVE-2019-3843 | — | < 234-24.30.1 | 234-24.30.1 | Apr 26, 2019 | It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a | ||
| CVE-2019-3844 | — | < 234-24.30.1 | 234-24.30.1 | Apr 26, 2019 | It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access r | ||
| CVE-2019-3842 | — | < 234-24.30.1 | 234-24.30.1 | Apr 9, 2019 | In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be | ||
| CVE-2019-6454 | — | < 234-24.30.1 | 234-24.30.1 | Mar 17, 2019 | An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a speciall |
- CVE-2020-1712Mar 31, 2020affected < 234-24.46.1fixed 234-24.46.1
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate thei
- CVE-2019-20386Jan 21, 2020affected < 234-24.39.1fixed 234-24.39.1
An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.
- CVE-2019-3843Apr 26, 2019affected < 234-24.30.1fixed 234-24.30.1
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a
- CVE-2019-3844Apr 26, 2019affected < 234-24.30.1fixed 234-24.30.1
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access r
- CVE-2019-3842Apr 9, 2019affected < 234-24.30.1fixed 234-24.30.1
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be
- CVE-2019-6454Mar 17, 2019affected < 234-24.30.1fixed 234-24.30.1
An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a speciall