CVE-2014-9770

tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
opensuseopensuse
13.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
systemd
bookworm
252.30-1~deb12u2
fixed
bullseye
247.3-7+deb11u5
fixed
bullseye (security)
247.3-7+deb11u6
fixed
sid
256.7-3
fixed
trixie
256.7-3
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
systemd
precise
dne
trusty
not-affected
wily
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libgudev-1_0-0-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
libgudev-1_0-0-32bit-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
libudev1-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
libudev1-32bit-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
systemd-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
systemd-32bit-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
systemd-bash-completion-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
systemd-sysvinit-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
udev-210
suse enterprise sap 12
70.48.1
fixed
suse enterprise sap 12 SP1
104.1
fixed
suse enterprise server 12
70.48.1
fixed
suse enterprise server 12 SP1
104.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00044.html
http://lists.opensuse.org/opensuse-updates/2016-05/msg00109.html
http://www.openwall.com/lists/oss-security/2016/04/08/14
http://www.openwall.com/lists/oss-security/2016/04/08/15
https://bugzilla.suse.com/show_bug.cgi?id=972612
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00044.html
http://lists.opensuse.org/opensuse-updates/2016-05/msg00109.html
http://www.openwall.com/lists/oss-security/2016/04/08/14
http://www.openwall.com/lists/oss-security/2016/04/08/15
https://bugzilla.suse.com/show_bug.cgi?id=972612