From ${URL} : 1. systemd: Integer overflow, leading to heap-based buffer overflow by processing native messages https://bugzilla.redhat.com/show_bug.cgi?id=859051 2. systemd: TOCTOU race condition when updating file permissions and SELinux security contexts https://bugzilla.redhat.com/show_bug.cgi?id=859060 3. systemd: Possibility of denial of logging service by processing native messages from file https://bugzilla.redhat.com/show_bug.cgi?id=859104 4. systemd: Improper sanitization of invalid XKB layouts descriptions (privilege escalation when custom PolicyKit local authority file used) https://bugzilla.redhat.com/show_bug.cgi?id=862324 @maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Vulnerability 1,3,4 are fixed in systemd-208. Vulnerability 2 is not fixed.
CVE-2013-4394 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4394): The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters." CVE-2013-4393 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4393): journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor. CVE-2013-4392 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4392): systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files. CVE-2013-4391 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4391): Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.
We will split out the 2nd issue (CVE-2013-4392) which is still present and move it into an own bug so we can proceed with the rest. v208 landed in Gentoo repository via https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/sys-apps/systemd/systemd-208.ebuild?hideattic=0&view=log Current stable ebuild is >=sys-apps/systemd-218-r5 and no vulnerable ebuilds left.
This issue was resolved and addressed in GLSA 201612-34 at https://security.gentoo.org/glsa/201612-34 by GLSA coordinator Aaron Bauman (b-man).
