Security update for systemd SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:1844-1 Final 1 1 2017-07-12T12:22:24Z current 2017-07-12T12:22:24Z 2017-07-12T12:22:24Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for systemd This update for systemd fixes the following issues: Security issue fixed: - CVE-2017-9217: resolved: Fix null pointer p->question dereferencing that could lead to resolved aborting (bsc#1040614) The update also fixed several non-security bugs: - core/mount: Use the '-c' flag to not canonicalize paths when calling /bin/umount - automount: Handle expire_tokens when the mount unit changes its state (bsc#1040942) - automount: Rework propagation between automount and mount units - build: Make sure tmpfiles.d/systemd-remote.conf get installed when necessary - build: Fix systemd-journal-upload installation - basic: Detect XEN Dom0 as no virtualization (bsc#1036873) - virt: Make sure some errors are not ignored - fstab-generator: Do not skip Before= ordering for noauto mountpoints - fstab-gen: Do not convert device timeout into seconds when initializing JobTimeoutSec - core/device: Use JobRunningTimeoutSec= for device units (bsc#1004995) - fstab-generator: Apply the _netdev option also to device units (bsc#1004995) - job: Add JobRunningTimeoutSec for JOB_RUNNING state (bsc#1004995) - job: Ensure JobRunningTimeoutSec= survives serialization (bsc#1004995) - rules: Export NVMe WWID udev attribute (bsc#1038865) - rules: Introduce disk/by-id (model_serial) symbolic links for NVMe drives - rules: Add rules for NVMe devices - sysusers: Make group shadow support configurable (bsc#1029516) - core: When deserializing a unit, fully restore its cgroup state (bsc#1029102) - core: Introduce cg_mask_from_string()/cg_mask_to_string() - core:execute: Fix handling failures of calling fork() in exec_spawn() (bsc#1040258) - Fix systemd-sysv-convert when a package starts shipping service units (bsc#982303) The database might be missing when upgrading a package which was shipping no sysv init scripts nor unit files (at the time --save was called) but the new version start shipping unit files. - Disable group shadow support (bsc#1029516) - Only check signature job error if signature job exists (bsc#1043758) This update was imported from the SUSE:SLE-12-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-07/msg00054.html E-Mail link for openSUSE-SU-2017:1844-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 libsystemd0-228-25.6.1 libsystemd0-32bit-228-25.6.1 libsystemd0-mini-228-25.6.1 libudev-devel-228-25.6.1 libudev-mini-devel-228-25.6.1 libudev-mini1-228-25.6.1 libudev1-228-25.6.1 libudev1-32bit-228-25.6.1 nss-myhostname-228-25.6.1 nss-myhostname-32bit-228-25.6.1 nss-mymachines-228-25.6.1 systemd-228-25.6.1 systemd-32bit-228-25.6.1 systemd-bash-completion-228-25.6.1 systemd-devel-228-25.6.1 systemd-logger-228-25.6.1 systemd-mini-228-25.6.1 systemd-mini-bash-completion-228-25.6.1 systemd-mini-devel-228-25.6.1 systemd-mini-sysvinit-228-25.6.1 systemd-sysvinit-228-25.6.1 udev-228-25.6.1 udev-mini-228-25.6.1 libsystemd0-228-25.6.1 as a component of openSUSE Leap 42.2 libsystemd0-32bit-228-25.6.1 as a component of openSUSE Leap 42.2 libsystemd0-mini-228-25.6.1 as a component of openSUSE Leap 42.2 libudev-devel-228-25.6.1 as a component of openSUSE Leap 42.2 libudev-mini-devel-228-25.6.1 as a component of openSUSE Leap 42.2 libudev-mini1-228-25.6.1 as a component of openSUSE Leap 42.2 libudev1-228-25.6.1 as a component of openSUSE Leap 42.2 libudev1-32bit-228-25.6.1 as a component of openSUSE Leap 42.2 nss-myhostname-228-25.6.1 as a component of openSUSE Leap 42.2 nss-myhostname-32bit-228-25.6.1 as a component of openSUSE Leap 42.2 nss-mymachines-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-32bit-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-bash-completion-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-devel-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-logger-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-mini-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-mini-bash-completion-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-mini-devel-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-mini-sysvinit-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-sysvinit-228-25.6.1 as a component of openSUSE Leap 42.2 udev-228-25.6.1 as a component of openSUSE Leap 42.2 udev-mini-228-25.6.1 as a component of openSUSE Leap 42.2 systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section. CVE-2017-9217 openSUSE Leap 42.2:libsystemd0-228-25.6.1 openSUSE Leap 42.2:libsystemd0-32bit-228-25.6.1 openSUSE Leap 42.2:libsystemd0-mini-228-25.6.1 openSUSE Leap 42.2:libudev-devel-228-25.6.1 openSUSE Leap 42.2:libudev-mini-devel-228-25.6.1 openSUSE Leap 42.2:libudev-mini1-228-25.6.1 openSUSE Leap 42.2:libudev1-228-25.6.1 openSUSE Leap 42.2:libudev1-32bit-228-25.6.1 openSUSE Leap 42.2:nss-myhostname-228-25.6.1 openSUSE Leap 42.2:nss-myhostname-32bit-228-25.6.1 openSUSE Leap 42.2:nss-mymachines-228-25.6.1 openSUSE Leap 42.2:systemd-228-25.6.1 openSUSE Leap 42.2:systemd-32bit-228-25.6.1 openSUSE Leap 42.2:systemd-bash-completion-228-25.6.1 openSUSE Leap 42.2:systemd-devel-228-25.6.1 openSUSE Leap 42.2:systemd-logger-228-25.6.1 openSUSE Leap 42.2:systemd-mini-228-25.6.1 openSUSE Leap 42.2:systemd-mini-bash-completion-228-25.6.1 openSUSE Leap 42.2:systemd-mini-devel-228-25.6.1 openSUSE Leap 42.2:systemd-mini-sysvinit-228-25.6.1 openSUSE Leap 42.2:systemd-sysvinit-228-25.6.1 openSUSE Leap 42.2:udev-228-25.6.1 openSUSE Leap 42.2:udev-mini-228-25.6.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-07/msg00054.html https://www.suse.com/security/cve/CVE-2017-9217.html CVE-2017-9217 https://bugzilla.suse.com/1040614 SUSE Bug 1040614