Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-15686

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

Published

2018-10-26T14:29:00.613

Last Modified

2025-06-09T16:15:28.243

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-502
  • Type: Secondary
    CWE-502
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System canonical ubuntu_linux 16.04 Yes
Operating System canonical ubuntu_linux 18.04 Yes
Operating System canonical ubuntu_linux 18.10 Yes
Operating System debian debian_linux 8.0 Yes
Application systemd_project systemd ≤ 239 Yes
Application oracle communications_cloud_native_core_network_function_cloud_native_environment 1.4.0 Yes
References