Bug 48499 - systemd: Multiple issues (4.3)
systemd: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-3-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-01-21 14:56 CET by Quality Assurance
Modified: 2019-01-23 14:21 CET (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2019-01-21 14:56:06 CET
New Debian systemd 232-25+deb9u8A~4.3.3.201901211455 fixes:
This update addresses the following issues:

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()

* 232-25+deb9u8 (Tue, 15 Jan 2019 10:59:43 +0100) * Non-maintainer upload by  the Security Team. * Address memory leak in dispatch_message_real() In  dispatch_message_real() memory allocated by set_iovec_field_free() is not  free()d. Follow upstream and introduce specific variables cmdline1 and  cmdline2 and free() those automatically when dispatch_message_real()  returns. * Correctly allocate core_timestamp on the heap and avoid invalid  free() * Remove unused core* variables in process_kernel()
* memory leak in journald-server.c introduced by fix for CVE-2018-16864  (CVE-2019-3815)
Comment 1 Quality Assurance univentionstaff 2019-01-21 15:37:02 CET
--- mirror/ftp/4.3/unmaintained/component/4.3-3-errata/source/systemd_232-25+deb9u7A~4.3.3.201901140821.dsc
+++ apt/ucs_4.3-0-errata4.3-3/source/systemd_232-25+deb9u8A~4.3.3.201901211455.dsc
@@ -1,8 +1,19 @@
-232-25+deb9u7A~4.3.3.201901140821 [Mon, 14 Jan 2019 08:21:49 +0100] Univention builddaemon <buildd@univention.de>:
+232-25+deb9u8A~4.3.3.201901211455 [Mon, 21 Jan 2019 14:56:52 +0100] Univention builddaemon <buildd@univention.de>:
 
   * UCS auto build. The following patches have been applied to the original source package
     01-fix-ftbfs
     10-ignore-ucs-divered
+
+232-25+deb9u8 [Tue, 15 Jan 2019 10:59:43 +0100] Salvatore Bonaccorso <carnil@debian.org>:
+
+  * Non-maintainer upload by the Security Team.
+  * Address memory leak in dispatch_message_real()
+    In dispatch_message_real() memory allocated by set_iovec_field_free()
+    is not free()d.
+    Follow upstream and introduce specific variables cmdline1 and cmdline2
+    and free() those automatically when dispatch_message_real() returns.
+  * Correctly allocate core_timestamp on the heap and avoid invalid free()
+  * Remove unused core* variables in process_kernel()
 
 232-25+deb9u7 [Sat, 12 Jan 2019 09:38:38 +0100] Salvatore Bonaccorso <carnil@debian.org>:
 

<http://10.200.17.11/4.3-3/#584459097192793821>
Comment 2 Philipp Hahn univentionstaff 2019-01-21 16:25:19 CET
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.3-3] 83855750de Bug #48499: systemd 232-25+deb9u8A~4.3.3.201901211455
 doc/errata/staging/systemd.yaml | 43 +----------------------------------------
 1 file changed, 1 insertion(+), 42 deletions(-)

[4.3-3] 00b49995ab Bug #48499: systemd 232-25+deb9u8A~4.3.3.201901211455
 doc/errata/staging/systemd.yaml | 54 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
Comment 3 Arvid Requate univentionstaff 2019-01-23 14:21:58 CET
<http://errata.software-univention.de/ucs/4.3/409.html>