* SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
- debian/patches/CVE-2018-16864.patch: journald: do not store the iovec
entry for process commandline on the stack
- CVE-2018-16864
* SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
- debian/patches/CVE-2018-16865_1.patch: journald: set a limit on the
number of fields (1k)
- debian/patches/CVE-2018-16865_2.patch: journal-remote: set a limit on the
number of fields in a message
- CVE-2018-16865
* SECURITY UPDATE: out-of-bounds read in journald
- debian/patches/CVE-2018-16866.patch: journal: fix syslog_parse_identifier()
- CVE-2018-16866
* SECURITY UPDATE: symlink mishandling in systemd-tmpfiles
- debian/patches/CVE-2018-6954.patch: don't resolve pathnames when traversing
recursively through directory trees
- debian/patches/CVE-2018-6954_2.patch: backport the remaining patches to
resolve this completely
- CVE-2018-6954
A security fix has superseded the current SRU. The SRU will need to be restarted from scratch.
debian/changelog
--
systemd (229-4ubuntu21.15) xenial-security; urgency=medium
* SECURITY UPDATE: memory corruption in journald via attacker controlled alloca patches/ CVE-2018- 16864.patch: journald: do not store the iovec patches/ CVE-2018- 16865_1. patch: journald: set a limit on the patches/ CVE-2018- 16865_2. patch: journal-remote: set a limit on the patches/ CVE-2018- 16866.patch: journal: fix syslog_ parse_identifie r() patches/ CVE-2018- 6954.patch: don't resolve pathnames when traversing patches/ CVE-2018- 6954_2. patch: backport the remaining patches to
- debian/
entry for process commandline on the stack
- CVE-2018-16864
* SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
- debian/
number of fields (1k)
- debian/
number of fields in a message
- CVE-2018-16865
* SECURITY UPDATE: out-of-bounds read in journald
- debian/
- CVE-2018-16866
* SECURITY UPDATE: symlink mishandling in systemd-tmpfiles
- debian/
recursively through directory trees
- debian/
resolve this completely
- CVE-2018-6954
* Fix LP: #1804603 - btrfs-util: unbreak tmpfiles' subvol creation patches/ btrfs-util- unbreak- tmpfiles- subvol- creation. patch patches/ series patches/ test-Set- executable- bits-on- TEST-22- TMPFILES- shell-script. patch patches/ series
- add debian/
- update debian/
* Fix LP: #1804864 - test: Set executable bits on TEST-22-TMPFILES shell scripts
- add debian/
- update debian/
-- Chris Coulson <email address hidden> Thu, 10 Jan 2019 00:15:47 +0000
--