A use-after-free vulnerability was found in systemd

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g

A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be…

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned…

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the…

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the…

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command…

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors…

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows…

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their…

In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window()…

In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small

systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges…

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output

An exploitable denial-of-service vulnerability exists in Systemd 245

Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes

In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel…

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element

In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running

systemd: Local unprivileged user can trigger an assert

A vulnerability was found in systemd

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c

A flaw was found in systemd

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled…

systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure)

An issue was discovered in sd-bus in systemd 239

The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which…

The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message…

An issue was discovered in systemd 253

An issue was discovered in systemd 253

An issue was discovered in systemd 253

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted,…

systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and…

In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'

An issue was discovered in button_open in login/logind-button.c in systemd before 243