Security update for systemd SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:1351-1 Final 1 1 2016-05-18T13:21:09Z current 2016-05-18T13:21:09Z 2016-05-18T13:21:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for systemd This update for SystemD provides fixes and enhancements. The following security issue has been fixed: - Don't allow read access to journal files to users. (bsc#972612, CVE-2014-9770, CVE-2015-8842) The following non-security issues have been fixed: - Restore initrd-udevadm-cleanup-db.service. (bsc#978275, bsc#976766) - Incorrect permissions set after boot on journal files. (bsc#973848) - Exclude device-mapper from block device ownership event locking. (bsc#972727) - Explicitly set mode for /run/log. - Don't apply sgid and executable bit to journal files, only the directories they are contained in. - Add ability to mask access mode by pre-existing access mode on files/directories. - No need to pass --all if inactive is explicitly requested in list-units. (bsc#967122) - Fix automount option and don't start associated mount unit at boot. (bsc#970423) - Support more than just power-gpio-key. (fate#318444, bsc#970860) - Add standard gpio power button support. (fate#318444, bsc#970860) - Downgrade warnings about wanted unit which are not found. (bsc#960158) - Shorten hostname before checking for trailing dot. (bsc#965897) - Remove WorkingDirectory parameter from emergency, rescue and console-shell.service. (bsc#959886) - Don't ship boot.udev and systemd-journald.init anymore. - Revert 'log: honour the kernel's quiet cmdline argument'. (bsc#963230) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2016-791,SUSE-SLE-SDK-12-2016-791,SUSE-SLE-SERVER-12-2016-791 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20161351-1/ Link for SUSE-SU-2016:1351-1 https://lists.suse.com/pipermail/sle-security-updates/2016-May/002071.html E-Mail link for SUSE-SU-2016:1351-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/959886 SUSE Bug 959886 https://bugzilla.suse.com/960158 SUSE Bug 960158 https://bugzilla.suse.com/963230 SUSE Bug 963230 https://bugzilla.suse.com/965897 SUSE Bug 965897 https://bugzilla.suse.com/967122 SUSE Bug 967122 https://bugzilla.suse.com/970423 SUSE Bug 970423 https://bugzilla.suse.com/970860 SUSE Bug 970860 https://bugzilla.suse.com/972612 SUSE Bug 972612 https://bugzilla.suse.com/972727 SUSE Bug 972727 https://bugzilla.suse.com/973848 SUSE Bug 973848 https://bugzilla.suse.com/976766 SUSE Bug 976766 https://bugzilla.suse.com/978275 SUSE Bug 978275 https://www.suse.com/security/cve/CVE-2014-9770/ SUSE CVE CVE-2014-9770 page https://www.suse.com/security/cve/CVE-2015-8842/ SUSE CVE CVE-2015-8842 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 libgudev-1_0-0-210-70.48.1 libgudev-1_0-0-32bit-210-70.48.1 libudev1-210-70.48.1 libudev1-32bit-210-70.48.1 systemd-210-70.48.1 systemd-32bit-210-70.48.1 systemd-bash-completion-210-70.48.1 systemd-sysvinit-210-70.48.1 udev-210-70.48.1 libgudev-1_0-devel-210-70.48.1 libudev-devel-210-70.48.1 systemd-devel-210-70.48.1 typelib-1_0-GUdev-1_0-210-70.48.1 libgudev-1_0-0-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 libgudev-1_0-0-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 libudev1-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 libudev1-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 systemd-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 systemd-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 systemd-bash-completion-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 systemd-sysvinit-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 udev-210-70.48.1 as a component of SUSE Linux Enterprise Desktop 12 libgudev-1_0-0-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 libgudev-1_0-0-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 libudev1-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 libudev1-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 systemd-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 systemd-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 systemd-bash-completion-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 systemd-sysvinit-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 udev-210-70.48.1 as a component of SUSE Linux Enterprise Server 12 libgudev-1_0-0-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libgudev-1_0-0-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libudev1-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libudev1-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 systemd-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 systemd-32bit-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 systemd-bash-completion-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 systemd-sysvinit-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 udev-210-70.48.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libgudev-1_0-devel-210-70.48.1 as a component of SUSE Linux Enterprise Software Development Kit 12 libudev-devel-210-70.48.1 as a component of SUSE Linux Enterprise Software Development Kit 12 systemd-devel-210-70.48.1 as a component of SUSE Linux Enterprise Software Development Kit 12 typelib-1_0-GUdev-1_0-210-70.48.1 as a component of SUSE Linux Enterprise Software Development Kit 12 tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files. CVE-2014-9770 SUSE Linux Enterprise Desktop 12:libgudev-1_0-0-210-70.48.1 SUSE Linux Enterprise Desktop 12:libgudev-1_0-0-32bit-210-70.48.1 SUSE Linux Enterprise Desktop 12:libudev1-210-70.48.1 SUSE Linux Enterprise Desktop 12:libudev1-32bit-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-32bit-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-bash-completion-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-sysvinit-210-70.48.1 SUSE Linux Enterprise Desktop 12:udev-210-70.48.1 SUSE Linux Enterprise Server 12:libgudev-1_0-0-210-70.48.1 SUSE Linux Enterprise Server 12:libgudev-1_0-0-32bit-210-70.48.1 SUSE Linux Enterprise Server 12:libudev1-210-70.48.1 SUSE Linux Enterprise Server 12:libudev1-32bit-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-32bit-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-bash-completion-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-sysvinit-210-70.48.1 SUSE Linux Enterprise Server 12:udev-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libgudev-1_0-0-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libgudev-1_0-0-32bit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libudev1-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libudev1-32bit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-32bit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-bash-completion-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-sysvinit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:udev-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:libgudev-1_0-devel-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:libudev-devel-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:systemd-devel-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:typelib-1_0-GUdev-1_0-210-70.48.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161351-1/ https://www.suse.com/security/cve/CVE-2014-9770.html CVE-2014-9770 https://bugzilla.suse.com/972612 SUSE Bug 972612 tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file. CVE-2015-8842 SUSE Linux Enterprise Desktop 12:libgudev-1_0-0-210-70.48.1 SUSE Linux Enterprise Desktop 12:libgudev-1_0-0-32bit-210-70.48.1 SUSE Linux Enterprise Desktop 12:libudev1-210-70.48.1 SUSE Linux Enterprise Desktop 12:libudev1-32bit-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-32bit-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-bash-completion-210-70.48.1 SUSE Linux Enterprise Desktop 12:systemd-sysvinit-210-70.48.1 SUSE Linux Enterprise Desktop 12:udev-210-70.48.1 SUSE Linux Enterprise Server 12:libgudev-1_0-0-210-70.48.1 SUSE Linux Enterprise Server 12:libgudev-1_0-0-32bit-210-70.48.1 SUSE Linux Enterprise Server 12:libudev1-210-70.48.1 SUSE Linux Enterprise Server 12:libudev1-32bit-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-32bit-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-bash-completion-210-70.48.1 SUSE Linux Enterprise Server 12:systemd-sysvinit-210-70.48.1 SUSE Linux Enterprise Server 12:udev-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libgudev-1_0-0-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libgudev-1_0-0-32bit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libudev1-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:libudev1-32bit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-32bit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-bash-completion-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:systemd-sysvinit-210-70.48.1 SUSE Linux Enterprise Server for SAP Applications 12:udev-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:libgudev-1_0-devel-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:libudev-devel-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:systemd-devel-210-70.48.1 SUSE Linux Enterprise Software Development Kit 12:typelib-1_0-GUdev-1_0-210-70.48.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20161351-1/ https://www.suse.com/security/cve/CVE-2015-8842.html CVE-2015-8842 https://bugzilla.suse.com/972612 SUSE Bug 972612