This bug was fixed in the package systemd - 237-3ubuntu10.38 --------------- systemd (237-3ubuntu10.38) bionic-security; urgency=medium
* SECURITY UPDATE: local privilege escalation via DynamicUser - debian/patches/CVE-2019-384x-1.patch: introduce seccomp_restrict_suid_sgid() for blocking chmod() for suid/sgid files in src/shared/seccomp-util.c, src/shared/seccomp-util.h. - debian/patches/CVE-2019-384x-2.patch: add test case for restrict_suid_sgid() in src/test/test-seccomp.c. - debian/patches/CVE-2019-384x-3.patch: expose SUID/SGID restriction as new unit setting RestrictSUIDSGID= in src/core/dbus-execute.c, src/core/execute.c, src/core/execute.h, src/core/load-fragment-gperf.gperf.m4, src/shared/bus-unit-util.c. - debian/patches/CVE-2019-384x-4.patch: document the new RestrictSUIDSGID= setting in man/systemd.exec.xml. - debian/patches/CVE-2019-384x-5.patch: turn on RestrictSUIDSGID= in most of our long-running daemons in units/systemd-*.service.in. - debian/patches/CVE-2019-384x-6.patch: imply NNP and SUID/SGID restriction for DynamicUser=yes service in man/systemd.exec.xml, src/core/unit.c. - debian/patches/CVE-2019-384x-7.patch: fix compilation on arm64 in src/test/test-seccomp.c. - CVE-2019-3843 - CVE-2019-3844 * SECURITY UPDATE: memory leak in button_open - debian/patches/CVE-2019-20386.patch: fix event in src/login/logind-button.c. - CVE-2019-20386 * SECURITY UPDATE: heap use-after-free with async polkit queries - debian/patches/CVE-2020-1712-1.patch: on async pk requests, re-validate action/details in src/shared/bus-util.c. - debian/patches/CVE-2020-1712-2.patch: introduce API for re-enqueuing incoming messages in src/libsystemd/libsystemd.sym, src/libsystemd/sd-bus/sd-bus.c, src/systemd/sd-bus.h. - debian/patches/CVE-2020-1712-3.patch: when authorizing via PK re-resolve callback/userdata instead of caching it in src/shared/bus-util.c. - debian/patches/CVE-2020-1712-4.patch: fix typo in function name in src/libsystemd/libsystemd.sym, src/libsystemd/sd-bus/sd-bus.c, src/systemd/sd-bus.h, src/shared/bus-util.c. - debian/libsystemd0.symbols: added new symbols. - CVE-2020-1712 * This package does _not_ contain the changes from 237-3ubuntu10.34 in bionic-proposed. -- Marc Deslauriers <marc.deslauri...@ubuntu.com> Tue, 04 Feb 2020 20:07:56 -0500 ** Changed in: systemd (Ubuntu Bionic) Status: Fix Committed => Fix Released ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-20386 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-3843 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-3844 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1712 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1671951 Title: networkd should allow configuring IPV6 MTU To manage notifications about this bug go to: https://bugs.launchpad.net/systemd/+bug/1671951/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs