Systemd_project Systemd
55 CVEs affecting Systemd_project Systemd. Latest disclosed: 2026-04-10. Critical: 4, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2526 | Critical | 9.8 | 2022-09-09 | A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-s… |
CVE-2018-21029 | Critical | 9.8 | 2019-10-30 | systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there… |
CVE-2015-7510 | Critical | 9.8 | 2017-09-25 | Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. |
CVE-2017-1000082 | Critical | 9.8 | 2017-07-07 | systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rath… |
CVE-2018-15688 | High | 8.8 | 2018-10-26 | A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases… |
CVE-2023-26604 | High | 7.8 | 2023-03-03 | systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl sta… |
CVE-2020-1712 | High | 7.8 | 2020-03-31 | A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages… |
CVE-2019-3844 | High | 7.8 | 2019-04-26 | It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to cre… |
CVE-2019-3843 | High | 7.8 | 2019-04-26 | It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID… |
CVE-2018-16865 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entrie… |
CVE-2018-16864 | High | 7.8 | 2019-01-11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program w… |
CVE-2018-15686 | High | 7.8 | 2018-10-26 | A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to i… |
CVE-2018-6954 | High | 7.8 | 2018-02-13 | systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary… |
CVE-2017-18078 | High | 7.8 | 2018-01-29 | systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned… |
CVE-2016-10156 | High | 7.8 | 2017-01-23 | A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers… |
CVE-2017-15908 | High | 7.5 | 2017-10-26 | In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_t… |
CVE-2017-9445 | High | 7.5 | 2017-06-28 | In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server c… |
CVE-2017-9217 | High | 7.5 | 2017-05-24 | systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section. |
CVE-2019-3842 | High | 7.0 | 2019-04-09 | In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible fo… |
CVE-2018-15687 | High | 7.0 | 2018-10-26 | A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd v… |