CVE-2018-15686

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
systemd	systemd	>= unspecified, <= 239

References

http://www.securityfocus.com/bid/105747Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2091Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3222Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0593Third Party Advisory
https://github.com/systemd/systemd/pull/10519Patch, Third Party Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/11/msg00017.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201810-10Third Party Advisory
https://usn.ubuntu.com/3816-1/Third Party Advisory
https://www.exploit-db.com/exploits/45714/Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
http://www.securityfocus.com/bid/105747Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2091Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3222Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0593Third Party Advisory
https://github.com/systemd/systemd/pull/10519Patch, Third Party Advisory
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/11/msg00017.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201810-10Third Party Advisory
https://usn.ubuntu.com/3816-1/Third Party Advisory
https://www.exploit-db.com/exploits/45714/Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory

Timeline

Published: Oct 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-156877.0A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected rel CVE-2018-156888.8A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd.CVE-2018-156919.8Insecure deserialization of a specially crafted serialized object, in CA Release Automation 6.5 and earlier, allows attackers to potentially CVE-2018-156926.4Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain fu CVE-2018-156936.4Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object referenc CVE-2018-156947.5ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a pat CVE-2018-156956.5ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to delete any file on the file system due to a path CVE-2018-156964.3ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts via user.cgi.CVE-2018-156976.5ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on a share by providing the full p CVE-2018-156986.5ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing CVE-2018-156996.1ASUSTOR Data Master 3.1.5 and below makes an HTTP request for a configuration file that is vulnerable to XSS. A man in the middle can take a CVE-2018-157006.5The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a cra