Bug 48499

Summary: systemd: Multiple issues (4.3)
Product: UCS Reporter: Quality Assurance <qa>
Component: Security updatesAssignee: Quality Assurance <qa>
Status: CLOSED FIXED QA Contact: Philipp Hahn <hahn>
Severity: normal    
Priority: P3    
Version: UCS 4.3   
Target Milestone: UCS 4.3-3-errata   
Hardware: All   
OS: Linux   
What kind of report is it?: Security Issue What type of bug is this?: ---
Who will be affected by this bug?: --- How will those affected feel about the bug?: ---
User Pain: Enterprise Customer affected?:
School Customer affected?: ISV affected?:
Waiting Support: Flags outvoted (downgraded) after PO Review:
Ticket number: Bug group (optional):
Max CVSS v3 score: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Description Quality Assurance univentionstaff 2019-01-21 14:56:06 CET 
New Debian systemd 232-25+deb9u8A~4.3.3.201901211455 fixes:
This update addresses the following issues:

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()
* memory leak in journald-server.c introduced by fix for CVE-2018-16864  (CVE-2019-3815)
Comment 1 Quality Assurance univentionstaff 2019-01-21 15:37:02 CET 
--- mirror/ftp/4.3/unmaintained/component/4.3-3-errata/source/systemd_232-25+deb9u7A~4.3.3.201901140821.dsc
+++ apt/ucs_4.3-0-errata4.3-3/source/systemd_232-25+deb9u8A~4.3.3.201901211455.dsc
@@ -1,8 +1,19 @@
-232-25+deb9u7A~4.3.3.201901140821 [Mon, 14 Jan 2019 08:21:49 +0100] Univention builddaemon <buildd@univention.de>:
+232-25+deb9u8A~4.3.3.201901211455 [Mon, 21 Jan 2019 14:56:52 +0100] Univention builddaemon <buildd@univention.de>:
 
   * UCS auto build. The following patches have been applied to the original source package
     01-fix-ftbfs
     10-ignore-ucs-divered
+
+232-25+deb9u8 [Tue, 15 Jan 2019 10:59:43 +0100] Salvatore Bonaccorso <carnil@debian.org>:
+
+  * Non-maintainer upload by the Security Team.
+  * Address memory leak in dispatch_message_real()
+    In dispatch_message_real() memory allocated by set_iovec_field_free()
+    is not free()d.
+    Follow upstream and introduce specific variables cmdline1 and cmdline2
+    and free() those automatically when dispatch_message_real() returns.
+  * Correctly allocate core_timestamp on the heap and avoid invalid free()
+  * Remove unused core* variables in process_kernel()
 
 232-25+deb9u7 [Sat, 12 Jan 2019 09:38:38 +0100] Salvatore Bonaccorso <carnil@debian.org>:
 

<http://10.200.17.11/4.3-3/#584459097192793821>
Comment 2 Philipp Hahn univentionstaff 2019-01-21 16:25:19 CET 
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.3-3] 83855750de Bug #48499: systemd 232-25+deb9u8A~4.3.3.201901211455
 doc/errata/staging/systemd.yaml | 43 +----------------------------------------
 1 file changed, 1 insertion(+), 42 deletions(-)

[4.3-3] 00b49995ab Bug #48499: systemd 232-25+deb9u8A~4.3.3.201901211455
 doc/errata/staging/systemd.yaml | 54 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
Comment 3 Arvid Requate univentionstaff 2019-01-23 14:21:58 CET 
<http://errata.software-univention.de/ucs/4.3/409.html>