systemd (229-4ubuntu21.27) xenial-security; urgency=medium
* SECURITY UPDATE: incorrect PIDFile verification
- debian/patches/CVE-2018-16888.patch: be stricter when handling PID
files and MAINPID sd_notify() messages in man/systemd.service.xml,
src/core/manager.c, src/core/service.c, src/core/unit.h,
test/TEST-20-MAINPIDGAMES/Makefile,
test/TEST-20-MAINPIDGAMES/test.sh,
test/TEST-20-MAINPIDGAMES/testsuite.sh, test/test-functions.
- debian/patches/CVE-2018-16888-2.patch: relax PID file symlink chain
checks a bit in src/core/service.c.
- CVE-2018-16888
* SECURITY UPDATE: memory leak in button_open
- debian/patches/CVE-2019-20386.patch: fix event in
src/login/logind-button.c.
- CVE-2019-20386
* SECURITY UPDATE: heap use-after-free with async polkit queries
- debian/patches/CVE-2020-1712-1.patch: on async pk requests,
re-validate action/details in src/shared/bus-util.c.
- debian/patches/CVE-2020-1712-2.patch: introduce API for re-enqueuing
incoming messages in src/libsystemd/libsystemd.sym,
src/libsystemd/sd-bus/sd-bus.c, src/systemd/sd-bus.h.
- debian/patches/CVE-2020-1712-3.patch: when authorizing via PK
re-resolve callback/userdata instead of caching it in
src/shared/bus-util.c.
- debian/patches/CVE-2020-1712-4.patch: fix typo in function name in
src/libsystemd/libsystemd.sym, src/libsystemd/sd-bus/sd-bus.c,
src/systemd/sd-bus.h, src/shared/bus-util.c.
- debian/libsystemd0.symbols: added new symbols.
- CVE-2020-1712
Date: 2020-02-05 13:46:02.736063+00:00
Changed-By: Marc Deslauriers <marc.deslauri...@canonical.com>
Signed-By: Ubuntu Archive Robot
<cjwatson+ubuntu-archive-ro...@chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/systemd/229-4ubuntu21.27
Sorry, changesfile not available.
--
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/xenial-changes
