USN-3816-1

Advisory lineage Upstream: 6 Downstream: 0
Published: 12 Nov 2018, 17:32
Last modified:22 Apr 2026, 09:52

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Nov 2018, 17:32
Published
Vulnerability first disclosed
22 Apr 2026, 09:52
Last Modified
Vulnerability information updated

Description

systemd vulnerabilities Jann Horn discovered that unit_deserialize incorrectly handled status messages above a certain length. A local attacker could potentially exploit this via NotifyAccess to inject arbitrary state across re-execution and obtain root privileges. (CVE-2018-15686) Jann Horn discovered a race condition in chown_one(). A local attacker could potentially exploit this by setting arbitrary permissions on certain files to obtain root privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-15687) It was discovered that systemd-tmpfiles mishandled symlinks in non-terminal path components. A local attacker could potentially exploit this by gaining ownership of certain files to obtain root privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-6954)

Affected Systems

  • ubuntu•systemd

    < 229-4ubuntu21.8 | < 237-3ubuntu10.6

References (4)