CVE-2018-16864

Published: 11 January 2019

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.

Priority

Cvss 3 Severity Score

7.8

Score breakdown

Status

Package	Release	Status
systemd Launchpad, Ubuntu, Debian	bionic	Released (237-3ubuntu10.11)
	cosmic	Released (239-7ubuntu10.6)
	trusty	Not vulnerable (code not built)
	upstream	Needs triage
	xenial	Released (229-4ubuntu21.15)

Severity score breakdown

Parameter	Value
Base score	7.8
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›