CVE-2018-15687: systemd: chown_one() can dereference symlinks
A race condition in chownone() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-15687?
CVE-2018-15687 is a race condition vulnerability in chown_one() of systemd that allows an attacker to set arbitrary permissions on arbitrary files.
Which versions of systemd are affected by CVE-2018-15687?
Affected releases are systemd versions up to and including 239.
What is the severity of CVE-2018-15687?
CVE-2018-15687 has a severity rating of high.
How can I fix CVE-2018-15687 in Ubuntu 16.04 LTS?
To fix CVE-2018-15687 in Ubuntu 16.04 LTS, update the systemd package to version 229-4ubuntu21.8 or higher.
Where can I find more information about CVE-2018-15687?
More information about CVE-2018-15687 can be found at the following references: [CVE-2018-15687](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15687), [Ubuntu Security Notice USN-3816-1](https://ubuntu.com/security/notices/USN-3816-1), [NVD CVE-2018-15687](https://nvd.nist.gov/vuln/detail/CVE-2018-15687).