Description
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
The systemd Project systemd
from v221 to v239affected
References
- https://www.debian.org/security/2019/dsa-4367 ↗
- https://security.netapp.com/advisory/ntap-20190117-0001/ ↗
- https://www.qualys.com/2019/01/09/system-down/system-down.txt ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16866 ↗
- https://usn.ubuntu.com/3855-1/ ↗
- http://www.securityfocus.com/bid/106527 ↗
- https://security.gentoo.org/glsa/201903-07 ↗
- http://www.openwall.com/lists/oss-security/2019/05/10/4 ↗
- https://seclists.org/bugtraq/2019/May/25 ↗
- http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html ↗
- http://seclists.org/fulldisclosure/2019/May/21 ↗
- https://access.redhat.com/errata/RHSA-2019:2091 ↗
- https://access.redhat.com/errata/RHSA-2019:3222 ↗
- https://access.redhat.com/errata/RHSA-2020:0593 ↗