UbuntuUpdates.org

Package "systemd"

Name: systemd

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • nss module to resolve hostnames for local container instances
  • nss module to resolve names via systemd-resolved
  • systemd container/nspawn tools
  • tools for storing and retrieving coredumps
Latest version: 229-4ubuntu21.27
Release: xenial (16.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "systemd" in Xenial

Repository Area Version
base universe 229-4ubuntu4
base main 229-4ubuntu4
security main 229-4ubuntu21.27
updates universe 229-4ubuntu21.31
updates main 229-4ubuntu21.31

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 229-4ubuntu21.27 2020-02-05 17:07:08 UTC

  systemd (229-4ubuntu21.27) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect PIDFile verification
    - debian/patches/CVE-2018-16888.patch: be stricter when handling PID
      files and MAINPID sd_notify() messages in man/systemd.service.xml,
      src/core/manager.c, src/core/service.c, src/core/unit.h,
      test/TEST-20-MAINPIDGAMES/Makefile,
      test/TEST-20-MAINPIDGAMES/test.sh,
      test/TEST-20-MAINPIDGAMES/testsuite.sh, test/test-functions.
    - debian/patches/CVE-2018-16888-2.patch: relax PID file symlink chain
      checks a bit in src/core/service.c.
    - CVE-2018-16888
  * SECURITY UPDATE: memory leak in button_open
    - debian/patches/CVE-2019-20386.patch: fix event in
      src/login/logind-button.c.
    - CVE-2019-20386
  * SECURITY UPDATE: heap use-after-free with async polkit queries
    - debian/patches/CVE-2020-1712-1.patch: on async pk requests,
      re-validate action/details in src/shared/bus-util.c.
    - debian/patches/CVE-2020-1712-2.patch: introduce API for re-enqueuing
      incoming messages in src/libsystemd/libsystemd.sym,
      src/libsystemd/sd-bus/sd-bus.c, src/systemd/sd-bus.h.
    - debian/patches/CVE-2020-1712-3.patch: when authorizing via PK
      re-resolve callback/userdata instead of caching it in
      src/shared/bus-util.c.
    - debian/patches/CVE-2020-1712-4.patch: fix typo in function name in
      src/libsystemd/libsystemd.sym, src/libsystemd/sd-bus/sd-bus.c,
      src/systemd/sd-bus.h, src/shared/bus-util.c.
    - debian/libsystemd0.symbols: added new symbols.
    - CVE-2020-1712

 -- Marc Deslauriers <email address hidden> Tue, 04 Feb 2020 20:07:56 -0500
Source diff to previous version
CVE-2018-16888 It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unpr
CVE-2019-20386 An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may
CVE-2020-1712 heap use-after-free vulnerability

Version: 229-4ubuntu21.21 2019-04-08 12:07:07 UTC

  systemd (229-4ubuntu21.21) xenial-security; urgency=medium

  * SECURITY UDPATE: Unsafe environment usage in pam_systemd.so leads to
    incorrect Policykit authorization
    - debian/patches/CVE-2019-3842.patch: Use secure_getenv() rather than
      getenv() in pam_systemd.c
    - CVE-2019-3842

 -- Chris Coulson <email address hidden> Fri, 29 Mar 2019 16:43:00 +0000
Source diff to previous version
CVE-2019-3842 RESERVED

Version: 229-4ubuntu21.16 2019-02-18 17:07:04 UTC

  systemd (229-4ubuntu21.16) xenial-security; urgency=medium

  * SECURITY UPDATE: denial of service via crafted dbus message
    - debian/patches/CVE-2019-6454.patch: sd-bus: enforce a size limit for
      dbus paths, and don't allocate them on the stack
    - debian/patches/sd-bus-if-we-receive-an-invalid-dbus-message-ignore-.patch:
      sd-bus: if we receive an invalid dbus message, ignore and proceeed
    - CVE-2019-6454

  * Do not remove multiple spaces after identifier in syslog message
    - add debian/patches/journal-do-not-remove-multiple-spaces-after-identifi.patch

 -- Chris Coulson <email address hidden> Wed, 13 Feb 2019 22:03:22 +0000
Source diff to previous version
CVE-2019-6454 systemd (PID1) crash with specially crafted D-Bus message

Version: 229-4ubuntu21.15 2019-01-11 04:10:05 UTC

  systemd (229-4ubuntu21.15) xenial-security; urgency=medium

  * SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
    - debian/patches/CVE-2018-16864.patch: journald: do not store the iovec
      entry for process commandline on the stack
    - CVE-2018-16864
  * SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
    - debian/patches/CVE-2018-16865_1.patch: journald: set a limit on the
      number of fields (1k)
    - debian/patches/CVE-2018-16865_2.patch: journal-remote: set a limit on the
      number of fields in a message
    - CVE-2018-16865
  * SECURITY UPDATE: out-of-bounds read in journald
    - debian/patches/CVE-2018-16866.patch: journal: fix syslog_parse_identifier()
    - CVE-2018-16866
  * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles
    - debian/patches/CVE-2018-6954.patch: don't resolve pathnames when traversing
      recursively through directory trees
    - debian/patches/CVE-2018-6954_2.patch: backport the remaining patches to
      resolve this completely
    - CVE-2018-6954

  * Fix LP: #1804603 - btrfs-util: unbreak tmpfiles' subvol creation
    - add debian/patches/btrfs-util-unbreak-tmpfiles-subvol-creation.patch
    - update debian/patches/series
  * Fix LP: #1804864 - test: Set executable bits on TEST-22-TMPFILES shell scripts
    - add debian/patches/test-Set-executable-bits-on-TEST-22-TMPFILES-shell-script.patch
    - update debian/patches/series

 -- Chris Coulson <email address hidden> Thu, 10 Jan 2019 00:15:47 +0000
Source diff to previous version
1804603 systemd-tmpfiles-setup.service fails on btrfs
1804864 autopkgtest regression TEST-22-TMPFILES are not executable
CVE-2018-16864 memory corruption
CVE-2018-16865 memory corruption
CVE-2018-16866 information leak, out-of-bounds read
CVE-2018-6954 systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of

Version: 229-4ubuntu21.10 2018-11-27 21:07:18 UTC

  systemd (229-4ubuntu21.10) xenial-security; urgency=medium

  [ Chris Coulson ]
  * Revert the fixes for CVE-2018-6954 for causing a regression when running
    in a container on old kernels (LP: #1804847)
    - update debian/patches/series

  [ Balint Reczey ]
  * Fix LP: #1803391 - Don't always trigger systemctl stop of udev service
    and sockets
    - update debian/udev.postinst

 -- Chris Coulson <email address hidden> Tue, 27 Nov 2018 11:10:48 +0000
1804847 systemd=229-4ubuntu21.8 use of fchownat failes on some systems (openvz)
1803391 Systemd update installation hangs in unattended-upgrades InstallOnShutdown mode
CVE-2018-6954 systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of


About   -   Send Feedback to @ubuntu_updates