CVE-2018-15686
7.8
HIGH
CVSS 3.1
EPSS 1.5%
Description
A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
How to fix CVE-2018-15686
To remediate CVE-2018-15686, upgrade the affected package to a fixed version below.
- Debian/systemd—upgrade to 239-12 or later
Is CVE-2018-15686 being exploited?
Low — EPSS is 1.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 239-12
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |