systemd (229-4ubuntu21.22) xenial; urgency=medium [ Dan Streetman ] * d/t/systemd-fsckd, d/t/cmdline-upstart-boot: - skip on s390x; requires grub (LP: #1830477) * d/p/ask-password-prevent-buffer-overrow-when-reading-fro.patch: - prevent buffer overflow when reading keyring (LP: #1814373) [ Dimitri John Ledkov ] * Specify Ubuntu's Vcs-Git [ Balint Reczey ] * Append /snap/bin to default PATH. Snapd ships snapd-env-generator, but systemd does not not support environment generators. Hard-coding /snap/bin is less risky than backporting environment generator support and since snaps are considered to be first class packages on Ubuntu /snap/bin can safely added to the default PATH. (LP: #1771858) [ Ioanna Alifieraki ] * d/p/systemctl-Replace-check_one_unit-by-get_state_one_un.patch - Backport upstream PR#2768 needed for next patch * d/p/systemctl-load-unit-if-needed-in-systemctl-is-active.patch - Backport upstream PR#7997 to fix alias service reports inactive while aliased is active (LP: #1828892) -- Dan Streetman Wed, 24 Apr 2019 17:15:36 -0400 systemd (229-4ubuntu21.21) xenial-security; urgency=medium * SECURITY UDPATE: Unsafe environment usage in pam_systemd.so leads to incorrect Policykit authorization - debian/patches/CVE-2019-3842.patch: Use secure_getenv() rather than getenv() in pam_systemd.c - CVE-2019-3842 -- Chris Coulson Fri, 29 Mar 2019 16:43:00 +0000 systemd (229-4ubuntu21.19) xenial; urgency=medium [ Michael Vogt ] * d/p/fix-race-daemon-reload-11121.patch: - backport systemd upstream PR#8803 and PR#11121 to fix race when doing systemctl and systemctl daemon-reload at the same time LP: #1819728 [ Balint Reczey ] * d/p/virt-detect-WSL-environment-as-a-container.patch: - virt: detect WSL environment as a container (LP: #1816753) -- Michael Vogt Mon, 25 Mar 2019 16:04:56 +0100 systemd (229-4ubuntu21.18) xenial; urgency=medium * d/p/fix-race-daemon-reload-8803.patch: - backport systemd upstream PR#8803 to fix race when doing systemctl and systemctl daemon-reload at the same time LP: #1819728 -- Michael Vogt Wed, 13 Mar 2019 16:17:45 +0100 systemd (229-4ubuntu21.17) xenial; urgency=medium [ Victor Tapia ] * d/p/stop-mount-error-propagation.patch: keep mount errors local to the failing mount point instead of blocking the processing of all mounts (LP: #1755863) [ Eric Desrochers ] * d/p/fix-egde-case-when-processing-proc-self-mountinfo.patch: Mounting any file system to a mount point in a directory that is bind mounted to itself will create an inactive mount unit. (LP: #1795764) -- Dan Streetman Thu, 28 Feb 2019 17:50:50 -0500 systemd (229-4ubuntu21.16) xenial-security; urgency=medium * SECURITY UPDATE: denial of service via crafted dbus message - debian/patches/CVE-2019-6454.patch: sd-bus: enforce a size limit for dbus paths, and don't allocate them on the stack - debian/patches/sd-bus-if-we-receive-an-invalid-dbus-message-ignore-.patch: sd-bus: if we receive an invalid dbus message, ignore and proceeed - CVE-2019-6454 * Do not remove multiple spaces after identifier in syslog message - add debian/patches/journal-do-not-remove-multiple-spaces-after-identifi.patch -- Chris Coulson Wed, 13 Feb 2019 22:03:22 +0000 systemd (229-4ubuntu21.15) xenial-security; urgency=medium * SECURITY UPDATE: memory corruption in journald via attacker controlled alloca - debian/patches/CVE-2018-16864.patch: journald: do not store the iovec entry for process commandline on the stack - CVE-2018-16864 * SECURITY UPDATE: memory corruption in journald via attacker controlled alloca - debian/patches/CVE-2018-16865_1.patch: journald: set a limit on the number of fields (1k) - debian/patches/CVE-2018-16865_2.patch: journal-remote: set a limit on the number of fields in a message - CVE-2018-16865 * SECURITY UPDATE: out-of-bounds read in journald - debian/patches/CVE-2018-16866.patch: journal: fix syslog_parse_identifier() - CVE-2018-16866 * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles - debian/patches/CVE-2018-6954.patch: don't resolve pathnames when traversing recursively through directory trees - debian/patches/CVE-2018-6954_2.patch: backport the remaining patches to resolve this completely - CVE-2018-6954 * Fix LP: #1804603 - btrfs-util: unbreak tmpfiles' subvol creation - add debian/patches/btrfs-util-unbreak-tmpfiles-subvol-creation.patch - update debian/patches/series * Fix LP: #1804864 - test: Set executable bits on TEST-22-TMPFILES shell scripts - add debian/patches/test-Set-executable-bits-on-TEST-22-TMPFILES-shell-script.patch - update debian/patches/series -- Chris Coulson Thu, 10 Jan 2019 00:15:47 +0000 systemd (229-4ubuntu21.10) xenial-security; urgency=medium [ Chris Coulson ] * Revert the fixes for CVE-2018-6954 for causing a regression when running in a container on old kernels (LP: #1804847) - update debian/patches/series [ Balint Reczey ] * Fix LP: #1803391 - Don't always trigger systemctl stop of udev service and sockets - update debian/udev.postinst -- Chris Coulson Tue, 27 Nov 2018 11:10:48 +0000 systemd (229-4ubuntu21.9) xenial-security; urgency=medium * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles - debian/patches/CVE-2018-6954_2.patch: backport the remaining patches to resolve this completely - CVE-2018-6954 -- Chris Coulson Thu, 15 Nov 2018 21:02:00 +0000 systemd (229-4ubuntu21.8) xenial-security; urgency=medium * SECURITY UPDATE: reexec state injection - debian/patches/CVE-2018-15686.patch: when deserializing state always use read_line(…, LONG_LINE_MAX, …) rather than fgets() - CVE-2018-15686 * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles - debian/patches/CVE-2018-6954.patch: don't resolve pathnames when traversing recursively through directory trees - CVE-2018-6954 -- Chris Coulson Thu, 08 Nov 2018 00:01:30 +0000 # For older changelog entries, run 'apt-get changelog libnss-myhostname'