CVE-2018-15686

Опубликовано: 26 окт. 2018

Источник: nvd

CVSS3: 7

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

Ссылки

http://www.securityfocus.com/bid/105747
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2091
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3222
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0593
Third Party Advisory
https://github.com/systemd/systemd/pull/10519
Patch
Third Party Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201810-10
Third Party Advisory
https://usn.ubuntu.com/3816-1/
Third Party Advisory
https://www.exploit-db.com/exploits/45714/
Exploit
Third Party Advisory
VDB Entry
https://www.oracle.com//security-alerts/cpujul2021.html
Third Party Advisory
http://www.securityfocus.com/bid/105747
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:2091
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3222
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0593
Third Party Advisory
https://github.com/systemd/systemd/pull/10519
Patch
Third Party Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201810-10
Third Party Advisory
https://usn.ubuntu.com/3816-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*

Версия до 239 (включая)

Конфигурация 3

cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 83%

0.0199

Низкий

7 High

CVSS3

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2018-15686

CVSS3: 7.8

ubuntu

почти 7 лет назад

CVE-2018-15686

CVSS3: 3.6

redhat

почти 7 лет назад

CVE-2018-15686

CVSS3: 7.8

msrc

около 5 лет назад

Описание отсутствует

CVE-2018-15686

CVSS3: 7.8

debian

почти 7 лет назад

A vulnerability in unit_deserialize of systemd allows an attacker to s ...

GHSA-86rx-vp92-xvgg

CVSS3: 7.8

github

больше 3 лет назад

EPSS

Процентиль: 83%

0.0199

Низкий

7 High

CVSS3

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-502