CVE-2019-3815

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
The systemd Project	systemd	v219-62.2 and newer

References

http://www.securityfocus.com/bid/106632Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0201Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3815Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00013.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/106632Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0201Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3815Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00013.htmlMailing List, Third Party Advisory

Timeline

Published: Jan 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38167.5Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemo CVE-2019-38178.8A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to ma CVE-2019-38187.5The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowi CVE-2019-38194.4A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loo CVE-2019-38204.3It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with CVE-2019-38217.5A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could CVE-2019-38229.8libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 CVE-2019-38237.5libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP.CVE-2019-38246.5A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.CVE-2019-38256.4A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen CVE-2019-38266.1A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convinc CVE-2019-38277.0An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by