Security update for systemd SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:1101-1 Final 1 1 2016-04-19T09:19:37Z current 2016-04-19T09:19:37Z 2016-04-19T09:19:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for systemd This update for systemd fixes several issues. These security issues were fixed: - CVE-2014-9770, CVE-2015-8842: Don't allow read access to journal files to users (boo#972612) These non-security issues were fixed: - Import commit 523777609a04fe9e590420e89f94ef07e3719baa: e5e362a udev: exclude MD from block device ownership event locking 8839413 udev: really exclude device-mapper from block device ownership event locking 66782e6 udev: exclude device-mapper from block device ownership event locking (boo#972727) 1386f57 tmpfiles: explicitly set mode for /run/log faadb74 tmpfiles: don't allow read access to journal files to users not in systemd-journal 9b1ef37 tmpfiles: don't apply sgid and executable bit to journal files, only the directories they are contained in 011c39f tmpfiles: add ability to mask access mode by pre-existing access mode on files/directories 07e2d60 tmpfiles: get rid of "m" lines d504e28 tmpfiles: various modernizations f97250d systemctl: no need to pass --all if inactive is explicitly requested in list-units (boo#967122) 2686573 fstab-generator: fix automount option and don't start associated mount unit at boot (boo#970423) 5c1637d login: support more than just power-gpio-key (fate#318444) (boo#970860) 2c95ecd logind: add standard gpio power button support (fate#318444) (boo#970860) af3eb93 Revert "log-target-null-instead-kmsg" 555dad4 shorten hostname before checking for trailing dot (boo#965897) 522194c Revert "log: honour the kernel's quiet cmdline argument" (boo#963230) cc94e47 transaction: downgrade warnings about wanted unit which are not found (boo#960158) eb3cfb3 Revert "vhangup-on-all-consoles" 0c28752 remove WorkingDirectory parameter from emergency, rescue and console-shell.service (boo#959886) 1d6d840 Fix wrong substitution variable name in systemd-udev-root-symlink.service.in (boo#964355) - Don't ship boot.udev and systemd-journald.init anymore. It was used during the systemd transition when both sysvinit and systemd could be used on the same system The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00044.html E-Mail link for openSUSE-SU-2016:1101-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 libgudev-1_0-0-210.1459453449.5237776-25.37.1 libgudev-1_0-0-32bit-210.1459453449.5237776-25.37.1 libgudev-1_0-0-debuginfo-210.1459453449.5237776-25.37.1 libgudev-1_0-0-debuginfo-32bit-210.1459453449.5237776-25.37.1 libgudev-1_0-devel-210.1459453449.5237776-25.37.1 libudev-devel-210.1459453449.5237776-25.37.1 libudev-mini-devel-210.1459453449.5237776-25.37.1 libudev-mini1-210.1459453449.5237776-25.37.1 libudev-mini1-debuginfo-210.1459453449.5237776-25.37.1 libudev1-210.1459453449.5237776-25.37.1 libudev1-32bit-210.1459453449.5237776-25.37.1 libudev1-debuginfo-210.1459453449.5237776-25.37.1 libudev1-debuginfo-32bit-210.1459453449.5237776-25.37.1 nss-myhostname-210.1459453449.5237776-25.37.1 nss-myhostname-32bit-210.1459453449.5237776-25.37.1 nss-myhostname-debuginfo-210.1459453449.5237776-25.37.1 nss-myhostname-debuginfo-32bit-210.1459453449.5237776-25.37.1 systemd-210.1459453449.5237776-25.37.1 systemd-32bit-210.1459453449.5237776-25.37.1 systemd-bash-completion-210.1459453449.5237776-25.37.1 systemd-debuginfo-210.1459453449.5237776-25.37.1 systemd-debuginfo-32bit-210.1459453449.5237776-25.37.1 systemd-debugsource-210.1459453449.5237776-25.37.1 systemd-devel-210.1459453449.5237776-25.37.1 systemd-journal-gateway-210.1459453449.5237776-25.37.1 systemd-journal-gateway-debuginfo-210.1459453449.5237776-25.37.1 systemd-logger-210.1459453449.5237776-25.37.1 systemd-mini-210.1459453449.5237776-25.37.1 systemd-mini-debuginfo-210.1459453449.5237776-25.37.1 systemd-mini-debugsource-210.1459453449.5237776-25.37.1 systemd-mini-devel-210.1459453449.5237776-25.37.1 systemd-mini-sysvinit-210.1459453449.5237776-25.37.1 systemd-sysvinit-210.1459453449.5237776-25.37.1 typelib-1_0-GUdev-1_0-210.1459453449.5237776-25.37.1 udev-210.1459453449.5237776-25.37.1 udev-debuginfo-210.1459453449.5237776-25.37.1 udev-mini-210.1459453449.5237776-25.37.1 udev-mini-debuginfo-210.1459453449.5237776-25.37.1 libgudev-1_0-0-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libgudev-1_0-0-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libgudev-1_0-0-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libgudev-1_0-0-debuginfo-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libgudev-1_0-devel-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev-devel-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev-mini-devel-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev-mini1-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev-mini1-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev1-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev1-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev1-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 libudev1-debuginfo-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 nss-myhostname-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 nss-myhostname-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 nss-myhostname-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 nss-myhostname-debuginfo-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-bash-completion-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-debuginfo-32bit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-debugsource-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-devel-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-journal-gateway-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-journal-gateway-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-logger-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-mini-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-mini-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-mini-debugsource-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-mini-devel-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-mini-sysvinit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 systemd-sysvinit-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 typelib-1_0-GUdev-1_0-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 udev-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 udev-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 udev-mini-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 udev-mini-debuginfo-210.1459453449.5237776-25.37.1 as a component of openSUSE 13.2 tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files. CVE-2014-9770 openSUSE 13.2:libgudev-1_0-0-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-0-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-0-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-0-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-mini-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-mini1-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-mini1-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-bash-completion-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-debugsource-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-journal-gateway-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-journal-gateway-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-logger-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-debugsource-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-sysvinit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-sysvinit-210.1459453449.5237776-25.37.1 openSUSE 13.2:typelib-1_0-GUdev-1_0-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-mini-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-mini-debuginfo-210.1459453449.5237776-25.37.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00044.html https://www.suse.com/security/cve/CVE-2014-9770.html CVE-2014-9770 https://bugzilla.suse.com/972612 SUSE Bug 972612 tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file. CVE-2015-8842 openSUSE 13.2:libgudev-1_0-0-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-0-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-0-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-0-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:libgudev-1_0-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-mini-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-mini1-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev-mini1-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:libudev1-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:nss-myhostname-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-bash-completion-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-debuginfo-32bit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-debugsource-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-journal-gateway-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-journal-gateway-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-logger-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-debugsource-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-devel-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-mini-sysvinit-210.1459453449.5237776-25.37.1 openSUSE 13.2:systemd-sysvinit-210.1459453449.5237776-25.37.1 openSUSE 13.2:typelib-1_0-GUdev-1_0-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-debuginfo-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-mini-210.1459453449.5237776-25.37.1 openSUSE 13.2:udev-mini-debuginfo-210.1459453449.5237776-25.37.1 important Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00044.html https://www.suse.com/security/cve/CVE-2015-8842.html CVE-2015-8842 https://bugzilla.suse.com/972612 SUSE Bug 972612