November 2014 - Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201411-13] php: denial of service
by Levente Polyak 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-13 ========================================== Severity: Medium Date : 2014-11-13 CVE-ID : CVE-2014-3710 Package : php Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package php before version 5.6.3-1 is vulnerable to denial of service through out-of-bounds read. Resolution ========== Upgrade to 5.6.3-1. # pacman -Syu "php>=5.6.3-1" The problem has been fixed upstream [0] in version 5.6.3. Workaround ========== None. Description =========== An out-of-bounds read flaw was found in the way the file information (fileinfo) extension parsed executable and linkable format (ELF) files. Impact ====== A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted ELF file. References ========== [0] http://git.php.net/?p=php-src.git;a=patch;h=180322 https://access.redhat.com/security/cve/CVE-2014-3710 https://bugzilla.redhat.com/show_bug.cgi?id=1155071 https://bugs.archlinux.org/task/42764 https://bugs.php.net/bug.php?id=68283

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-12] imagemagick: denial of service
by Remi Gacogne 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-12 ========================================== Severity: Low Date : 2014-11-13 CVE-ID : CVE-2014-8716 Package : imagemagick Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package imagemagick before version 6.8.9.10-1 is vulnerable to denial of service. Resolution ========== Upgrade to 6.8.9.10-1. # pacman -Syu "imagemagick>=6.8.9.10-1" The problem has been fixed upstream in version 6.8.9.10. Workaround ========== None. Description =========== Converting some specially crafted jpeg with convert could lead to a dos. Impact ====== An attacker capable of submitting a specially crafted jpeg passed to the convert command would be able to cause a crash resulting from an out-of-bound read. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8716 http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26456 http://seclists.org/oss-sec/2014/q4/569

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-11] flashplugin: remote code execution
by Remi Gacogne 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-11 ========================================== Severity: Critical Date : 2014-11-13 CVE-ID : CVE-2014-0573, CVE-2014-0574, CVE-2014-0576, CVE-2014-0577, CVE-2014-0581, CVE-2014-0582, CVE-2014-0583, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0588, CVE-2014-0589, CVE-2014-0590, CVE-2014-8437, CVE-2014-8438, CVE-2014-8440, CVE-2014-8441, CVE-2014-8442 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package flashplugin before version 11.2.202.418-1 is vulnerable to multiple flaws, allowing arbitrary remote code execution. Resolution ========== Upgrade to 11.2.202.418-1. # pacman -Syu "flashplugin>=11.2.202.418-1" The problem has been fixed upstream in version 11.2.202.418. Workaround ========== Disable or remove the flash plugin. Description =========== These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). These updates resolve a double free vulnerability that could lead to code execution (CVE-2014-0574). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589). These updates resolve an information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437). These updates resolve a heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). These updates resolve a permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442). Impact ====== A remote attacker in position of a man-in-the-middle or a malicious website can remotely execute arbitrary code with the privileges of the current user. References ========== https://helpx.adobe.com/security/products/flash-player/apsb14-24.html https://bugs.archlinux.org/task/42769 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0573 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0574 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0576 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0577 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0581 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0582 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0583 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0584 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0585 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0586 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0588 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0589 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0590 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8437 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8438 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8440 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8441 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8442

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-10] gnutls: out-of-bounds memory write
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-10 ========================================== Severity: Medium Date : 2014-11-12 CVE-ID : CVE-2014-8564 Package : gnutls Type : out-of-bounds memory write Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package gnutls before version 3.3.10-1 is vulnerable to out-of-bounds memory write resulting in denial of service or possibly code execution. Resolution ========== Upgrade to 3.3.10-1. # pacman -Syu "gnutls>=3.3.10-1" The problems have been fixed upstream [0] in version 3.3.10. Workaround ========== None. Description =========== An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR) resulting in heap corruption. Impact ====== A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application. References ========== [0] https://gitorious.org/gnutls/gnutls/commit/e821e19 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8564 http://www.gnutls.org/security.html#GNUTLS-SA-2014-5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8564

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-9] file: denial of service through out-of-bounds read
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-9 ========================================= Severity: Medium Date : 2014-11-12 CVE-ID : CVE-2014-3710 Package : file Type : denial of service through out-of-bounds read Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package file before version 5.20-2 is vulnerable to denial of service through out-of-bounds read. Resolution ========== Upgrade to 5.20-2. # pacman -Syu "file>=5.20-2" The problems have been fixed upstream [0] but no release version is available yet. Workaround ========== None. Description =========== An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash. Impact ====== A specially crafted elf file may lead to out-of-bounds read while parsing the note headers and lead to file executable crash. As readelf in file is widely used this could possibly lead to denial of service of middleware relying on it. References ========== [0] https://github.com/file/file/commit/39c7ac1106 https://access.redhat.com/security/cve/CVE-2014-3710 https://bugzilla.redhat.com/show_bug.cgi?id=1155071 https://bugs.archlinux.org/task/42759

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-8] mantisbt: arbitrary code execution and unrestricted access
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-8 ========================================= Severity: Critical Date : 2014-11-12 CVE-ID : CVE-2014-7146 CVE-2014-8598 Package : mantisbt Type : arbitrary code execution, unrestricted access Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mantisbt before version 1.2.17-4 is vulnerable to arbitrary code execution and unrestricted access. Resolution ========== Upgrade to 1.2.17-4. # pacman -Syu "mantisbt>=1.2.17-4" The problems have been fixed upstream [0][1] but no release version is available yet. Workaround ========== Uninstall the XML Import/Export plugin in mantisbt to avoid both vulnerabilities. Description =========== - CVE-2014-7146 (arbitrary code execution) When importing data with the plugin, user input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML file isn't properly sanitized before being used in a call to the preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary PHP code when the Import/Export plugin is installed. - CVE-2014-8598 (unrestricted access, information disclosure) The bundled XML Import/Export plugin does not perform any access level checks in the import and export pages. This allows any user knowing the URL to the plugin's page to insert or export any (confidential) data without restriction, regardless of their access level. This vulnerability is particularly dangerous when used in combination with the one described above (CVE-2014-7146) as it makes the access complexity very simple, allowing unauthenticated attackers to execute arbitrary code. Impact ====== A remote unauthenticated attacker knowing the URL to the plugin's page is able to export confidential information, insert data without any restriction or execute arbitrary code. References ========== [0] https://github.com/mantisbt/mantisbt/commit/bed19db9 [1] https://github.com/mantisbt/mantisbt/commit/80a15487 https://access.redhat.com/security/cve/CVE-2014-7146 https://access.redhat.com/security/cve/CVE-2014-8598 http://www.openwall.com/lists/oss-security/2014/11/07/27 http://www.openwall.com/lists/oss-security/2014/11/07/28 https://bugs.archlinux.org/task/42761

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-7] curl: out-of-bounds read
by Levente Polyak 11 Nov '14

11 Nov '14

Arch Linux Security Advisory ASA-201411-7 ========================================= Severity: Medium Date : 2014-11-11 CVE-ID : CVE-2014-3707 Package : curl Type : out-of-bounds read Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package curl before version 7.39.0-1 is vulnerable to out-of-bounds read which may lead to information disclosure. Resolution ========== Upgrade to 7.39.0-1. # pacman -Syu "curl>=7.39.0-1" The problem has been fixed upstream [0] in version 7.39.0. Workaround ========== None. Description =========== Symeon Paraschoudis discovered that the curl_easy_duphandle() function has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. Impact ====== This bug requires CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle() to be used in that order, and then the duplicate handle must be used to perform the HTTP POST. The curl command line tool is not affected by this problem as it does not use this sequence. References ========== [0] https://github.com/bagder/curl/commit/b38756 https://access.redhat.com/security/cve/CVE-2014-3707 http://curl.haxx.se/docs/adv_20141105.html

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-6] kdebase-workspace: local privilege escalation
by Remi Gacogne 10 Nov '14

10 Nov '14

Arch Linux Security Advisory ASA-201411-6 ========================================= Severity: Medium Date : 2014-11-10 CVE-ID : CVE-2014-8651 Package : kdebase-workspace Type : local privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package kdebase-workspace before version 4.11.13-2 is vulnerable to a local privilege escalation issue. Resolution ========== Upgrade to 4.11.13-2. # pacman -Syu "kdebase-workspace>=4.11.13-2" The problem has not been fixed upstream yet. Workaround ========== A polkit rule can be added to disable the org.kde.kcontrol.kcmclock.save action. Description =========== KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit. This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary command as root under the guise of updating the time. Impact ====== An local application can gain root privileges from an admin user with either misleading information or no interaction. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8651 http://seclists.org/oss-sec/2014/q4/520 https://git.reviewboard.kde.org/r/120977/ https://bugs.archlinux.org/task/42679

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-5] konversation: denial of service
by Levente Polyak 09 Nov '14

09 Nov '14

Arch Linux Security Advisory ASA-201411-5 ========================================= Severity: Low Date : 2014-11-09 CVE-ID : CVE-2014-8483 Package : konversation Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package konversation before version 1.5.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.1-1. # pacman -Syu "konversation>=1.5.1-1" The problem has been fixed upstream [0] in version 1.5.1. Workaround ========== None. Description =========== Konversation's Blowfish ECB encryption support assumes incoming blocks to be the expected 12 bytes. The lack of a sanity-check for the actual size can cause a denial of service and an information leak to the local user. Impact ====== When using Blowfish ECB encryption with another party (an IRC channel or user), sending malformed blocks to konversation can result in a crash or an information leak up to 11 bytes to the local user, due to an out-of-bounds read on a heap-allocated array. References ========== [0] https://github.com/quassel/quassel/commit/8b5ecd https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8483 https://bugs.archlinux.org/task/42698 https://www.kde.org/info/security/advisory-20141104-1.txt

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-4] polarssl: multiple issues
by Levente Polyak 06 Nov '14

06 Nov '14

Arch Linux Security Advisory ASA-201411-4 ========================================= Severity: Medium Date : 2014-11-06 CVE-ID : CVE-2014-8627, CVE-2014-8628 Package : polarssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package polarssl before version 1.3.9-1 is vulnerable to multiple issues including weak signature negotiation and remotely triggerable memory leaks. Resolution ========== Upgrade to 1.3.9-1. # pacman -Syu "polarssl>=1.3.9-1" The problem has been fixed upstream in version 1.3.9. Workaround ========== None. Description =========== - CVE-2014-8627 (weak signature negotiation) A mistake resulted in servers negotiating the lowest common hash from signature_algorithms extension in TLS 1.2. - CVE-2014-8628 (memory leaks) Two issues were found that result in remotely triggerable memory leaks when parsing crafted ClientHello messages or X.509 certificates. Impact ====== A remote attacker is able to trigger memory leaks which may result in memory exhaustion and therefore denial of service. Additionally due to weak negotiated signature algorithms an attacker may be able to perform cryptographic attacks. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8627 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8628 http://www.openwall.com/lists/oss-security/2014/11/04/6 https://github.com/polarssl/polarssl/commit/480905 https://github.com/polarssl/polarssl/commit/43c3b28 https://github.com/polarssl/polarssl/commit/5d8618

1 0