CVEvulnerability
CVE-2018-15686
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-10-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.0 ([email protected])
- 7.0 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-502
Description
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
Affected configurations
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• debian debian linux 8.0
• systemd project systemd (<= 239)
• oracle communications cloud native core network function cloud native environment 1.4.0
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://www.securityfocus.com/bid/105747 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2091 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3222 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0593 Third Party Advisory
- https://github.com/systemd/systemd/pull/10519 Patch, Third Party Advisory
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E lists.apache.org
- https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201810-10 Third Party Advisory
- https://usn.ubuntu.com/3816-1/ Third Party Advisory
- https://www.exploit-db.com/exploits/45714/ Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- http://www.securityfocus.com/bid/105747 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2091 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3222 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0593 Third Party Advisory
- https://github.com/systemd/systemd/pull/10519 Patch, Third Party Advisory
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E lists.apache.org
- https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201810-10 Third Party Advisory
- https://usn.ubuntu.com/3816-1/ Third Party Advisory
- https://www.exploit-db.com/exploits/45714/ Exploit, Third Party Advisory, VDB Entry
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory