[SECURITY] [DLA 1472-1] libcgroup security update

2018-08-2021:01:22

lists.debian.org

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

64.4%

JSON

Package : libcgroup
Version : 0.41-6+deb8u1
CVE ID : CVE-2018-14348
Debian Bug : 906308

The cgrulesengd daemon in libcgroup creates log files with world
readable and writable permissions due to a reset of the file mode
creation mask (umask(0)).

For Debian 8 "Jessie", this problem has been fixed in version
0.41-6+deb8u1.

We recommend that you upgrade your libcgroup packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8amd64libpam-cgroup< 0.41-6+deb8u1libpam-cgroup_0.41-6+deb8u1_amd64.deb
Debian9mipslibpam-cgroup-dbgsym< 0.41-8+deb9u1libpam-cgroup-dbgsym_0.41-8+deb9u1_mips.deb
Debian9mipsellibpam-cgroup< 0.41-8+deb9u1libpam-cgroup_0.41-8+deb9u1_mipsel.deb
Debian8amd64libcgroup-dbg< 0.41-6+deb8u1libcgroup-dbg_0.41-6+deb8u1_amd64.deb
Debian9armhflibcgroup1-dbgsym< 0.41-8+deb9u1libcgroup1-dbgsym_0.41-8+deb9u1_armhf.deb
Debian9amd64libpam-cgroup-dbgsym< 0.41-8+deb9u1libpam-cgroup-dbgsym_0.41-8+deb9u1_amd64.deb
Debian8armellibpam-cgroup< 0.41-6+deb8u1libpam-cgroup_0.41-6+deb8u1_armel.deb
Debian9i386libpam-cgroup-dbgsym< 0.41-8+deb9u1libpam-cgroup-dbgsym_0.41-8+deb9u1_i386.deb
Debian8amd64cgroup-tools< 0.41-6+deb8u1cgroup-tools_0.41-6+deb8u1_amd64.deb
Debian9mips64ellibcgroup-dev< 0.41-8+deb9u1libcgroup-dev_0.41-8+deb9u1_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	libpam-cgroup	< 0.41-6+deb8u1	libpam-cgroup_0.41-6+deb8u1_amd64.deb
Debian	9	mips	libpam-cgroup-dbgsym	< 0.41-8+deb9u1	libpam-cgroup-dbgsym_0.41-8+deb9u1_mips.deb
Debian	9	mipsel	libpam-cgroup	< 0.41-8+deb9u1	libpam-cgroup_0.41-8+deb9u1_mipsel.deb
Debian	8	amd64	libcgroup-dbg	< 0.41-6+deb8u1	libcgroup-dbg_0.41-6+deb8u1_amd64.deb
Debian	9	armhf	libcgroup1-dbgsym	< 0.41-8+deb9u1	libcgroup1-dbgsym_0.41-8+deb9u1_armhf.deb
Debian	9	amd64	libpam-cgroup-dbgsym	< 0.41-8+deb9u1	libpam-cgroup-dbgsym_0.41-8+deb9u1_amd64.deb
Debian	8	armel	libpam-cgroup	< 0.41-6+deb8u1	libpam-cgroup_0.41-6+deb8u1_armel.deb
Debian	9	i386	libpam-cgroup-dbgsym	< 0.41-8+deb9u1	libpam-cgroup-dbgsym_0.41-8+deb9u1_i386.deb
Debian	8	amd64	cgroup-tools	< 0.41-6+deb8u1	cgroup-tools_0.41-6+deb8u1_amd64.deb
Debian	9	mips64el	libcgroup-dev	< 0.41-8+deb9u1	libcgroup-dev_0.41-8+deb9u1_mips64el.deb