Systemd 241 Being Prepared With "System Down" Security Fixes

[Murple]

Interestingly it seems hreindl has a history of "childish" behaviour, "continuously ranting", contributing to a " toxic environment". My personal favourite is he "contributes nothing to <well known distro> development..."

I don't want to post personally identifiable information but his behaviour is certainly in keeping with his interactions with the wider community. Hey hreindl - it ain't us, its you

[Weasel]

Interestingly it seems hreindl has a history of "childish" behaviour, "continuously ranting", contributing to a " toxic environment". My personal favourite is he "contributes nothing to <well known distro> development..."

I don't want to post personally identifiable information but his behaviour is certainly in keeping with his interactions with the wider community. Hey hreindl - it ain't us, its you

Lol, now he resorted to posting meme pictures. It's like arguing on a gaming forum back in the days full of kids.

I admit I went a bit overboard with insults. Now I think back on it, I shouldn't have went that far. I get triggered easily especially by childish behavior. He's on my ignore list now (from the other thread).

[Murple]

He's on my ignore list now (from the other thread).

There's another thread?! *turns off computer, pulls out internet cable, smashes fuse box with a hammer, puts bag over my head and starts humming*

(*while dressed as a clown*, obviously)

[Murple]

syslog-ng: Use-after free in affile_dw_reap resulting in a denial of service
https://bugzilla.redhat.com/show_bug.cgi?id=1663935

Crashing an application and gaining root are not the same thing

[Murple]

likely you don't understand the impact of the problem
it's flagged as "code execution" at the security news list linking to the bugzilla

It has the potential, but unlikely. I can see the point you are *trying* to make but this differs from the journald bugs this thread is about because 1) this vulnerability isn't half as serious 2) there is no proof of concept or *actual* exploits known to exist 3) syslog-ng has a very small user base making it an unattractive target 4) if I was worried about overall security of syslog-ng I could remove it (if I was even using it, which I'm not) as a trivial procedure. I could not remove journald without *very significant* effort