January 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201501-15] jre8-openjdk: multiple issues
by Levente Polyak 23 Jan '15

23 Jan '15

Arch Linux Security Advisory ASA-201501-15 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2014-3566 CVE-2014-6549 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 CVE-2015-0421 CVE-2015-0437 Package : jre8-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk before version 8.u31-1 is vulnerable to multiple issues including bug not limited to arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle. Resolution ========== Upgrade to 8.u31-1. # pacman -Syu "jre8-openjdk>=8.u31-1" The problems have been fixed upstream in version 8.u31. Workaround ========== None. Description =========== - CVE-2014-3566 (man-in-the-middle) Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6549 (arbitrary code execution) Incorrect class loader permission check in ClassLoader getParent() allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2014-6585 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6587 (privilege escalation) MulticastSocket NULL pointer dereference allows local users to affect confidentiality, integrity, and availability. - CVE-2014-6591 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6593 (man-in-the-middle) Incorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows remote attackers to affect confidentiality and integrity. - CVE-2014-6601 (arbitrary code execution) Class verifier insufficient invokespecial calls verification related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0383 (denial of service) Insecure hsperfdata temporary file handling related to Hotspot allows local users to affect integrity and availability. - CVE-2015-0395 (arbitrary code execution) Phantom references handling issue in garbage collector related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0400 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of Java SE accessible data. - CVE-2015-0403 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0406 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of accessible data and ability to cause a partial denial of service. - CVE-2015-0407 (information disclosure) Directory information leak via file chooser related to Swing allows remote attackers to affect confidentiality. - CVE-2015-0408 (arbitrary code execution) Incorrect context class loader use in RMI transport allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0410 (denial of service) DER decoder infinite loop allows remote attackers to affect availability. - CVE-2015-0412 (arbitrary code execution) Insufficient code privileges checks related to JAX-WS allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0413 (unauthorized modification) Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. - CVE-2015-0421 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0437 (arbitrary code execution) Code generation issue related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. Impact ====== A remote attacker is able to perform arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle via various vulnerabilities. References ========== http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6549 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6585 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6591 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6593 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6601 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0383 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0395 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0400 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0403 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0406 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0407 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0408 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0410 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0412 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0413 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0421 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0437

1 0

[arch-security] [ASA-201501-14] jdk8-openjdk: multiple issues
by Levente Polyak 23 Jan '15

23 Jan '15

Arch Linux Security Advisory ASA-201501-14 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2014-3566 CVE-2014-6549 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 CVE-2015-0421 CVE-2015-0437 Package : jdk8-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk8-openjdk before version 8.u31-1 is vulnerable to multiple issues including bug not limited to arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle. Resolution ========== Upgrade to 8.u31-1. # pacman -Syu "jdk8-openjdk>=8.u31-1" The problems have been fixed upstream in version 8.u31. Workaround ========== None. Description =========== - CVE-2014-3566 (man-in-the-middle) Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6549 (arbitrary code execution) Incorrect class loader permission check in ClassLoader getParent() allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2014-6585 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6587 (privilege escalation) MulticastSocket NULL pointer dereference allows local users to affect confidentiality, integrity, and availability. - CVE-2014-6591 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6593 (man-in-the-middle) Incorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows remote attackers to affect confidentiality and integrity. - CVE-2014-6601 (arbitrary code execution) Class verifier insufficient invokespecial calls verification related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0383 (denial of service) Insecure hsperfdata temporary file handling related to Hotspot allows local users to affect integrity and availability. - CVE-2015-0395 (arbitrary code execution) Phantom references handling issue in garbage collector related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0400 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of Java SE accessible data. - CVE-2015-0403 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0406 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of accessible data and ability to cause a partial denial of service. - CVE-2015-0407 (information disclosure) Directory information leak via file chooser related to Swing allows remote attackers to affect confidentiality. - CVE-2015-0408 (arbitrary code execution) Incorrect context class loader use in RMI transport allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0410 (denial of service) DER decoder infinite loop allows remote attackers to affect availability. - CVE-2015-0412 (arbitrary code execution) Insufficient code privileges checks related to JAX-WS allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0413 (unauthorized modification) Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. - CVE-2015-0421 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0437 (arbitrary code execution) Code generation issue related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. Impact ====== A remote attacker is able to perform arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle via various vulnerabilities. References ========== http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6549 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6585 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6591 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6593 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6601 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0383 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0395 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0400 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0403 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0406 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0407 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0408 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0410 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0412 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0413 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0421 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0437

1 0

[arch-security] [ASA-201501-13] polarssl: remote code execution
by Remi Gacogne 20 Jan '15

20 Jan '15

Arch Linux Security Advisory ASA-201501-13 ========================================== Severity: Critical Date : 2015-01-20 CVE-ID : CVE-2015-1182 Package : polarssl Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package polarssl before version 1.3.9-2 is vulnerable to remote code execution. Resolution ========== Upgrade to 1.3.9-2. # pacman -Syu "polarssl>=1.3.9-2" The problem has not been fixed upstream yet. Workaround ========== None. Description =========== During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free(). This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate. Impact ====== An attacker may be able to remotely execute arbitrary code on the targeted system. References ========== https://polarssl.org/tech-updates/security-advisories/polarssl-security-adv… https://bugs.archlinux.org/task/43508

1 0

[arch-security] [ASA-201501-12] libssh: denial of service
by Levente Polyak 19 Jan '15

19 Jan '15

Arch Linux Security Advisory ASA-201501-12 ========================================== Severity: Medium Date : 2015-01-19 CVE-ID : CVE-2014-8132 Package : libssh Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libssh before version 0.6.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.6.4-1. # pacman -Syu "libssh>=0.6.4-1" The problem has been fixed upstream in version 0.6.4. Workaround ========== None. Description =========== It was discovered that a double free vulnerability in the ssh_packet_kexinit function in kex.c allows remote attackers to cause a denial of service via a crafted kexinit packet. Impact ====== A remote attacker is able to send a specially crafted kexinit packet causing libssh to crash, resulting in a denial of service. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8132 https://www.libssh.org/2014/12/19/libssh-0-6-4-security-and-bugfix-release/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8132

1 0

[arch-security] [ASA-201501-11] tinyproxy: denial of service
by Levente Polyak 19 Jan '15

19 Jan '15

Arch Linux Security Advisory ASA-201501-11 ========================================== Severity: Medium Date : 2015-01-19 CVE-ID : CVE-2012-3505 Package : tinyproxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tinyproxy before version 1.8.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "tinyproxy>=1.8.4-1" The problem has been fixed upstream in version 1.8.4. Workaround ========== None. Description =========== It was discovered that a remote attacker is able to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that predictably trigger hash collisions. Impact ====== A remote attacker is able to use specially crafted headers to predictably cause CPU and memory consumption leading to denial of service. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3505 https://bugzilla.banu.com/show_bug.cgi?id=110 https://bugs.archlinux.org/task/38400

1 0

[arch-security] [ASA-201501-10] samba: privilege elevation
by Levente Polyak 19 Jan '15

19 Jan '15

Arch Linux Security Advisory ASA-201501-10 ========================================== Severity: High Date : 2015-01-19 CVE-ID : CVE-2014-8143 Package : samba Type : privilege elevation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package samba before version 4.1.16-1 is vulnerable to privilege elevation when an Active Directory Domain Controller is configured. Resolution ========== Upgrade to 4.1.16-1. # pacman -Syu "samba>=4.1.16-1" The problem has been fixed upstream in version 4.1.16. Workaround ========== Do not delegate permission to create users or computers beyond the default of Domain Administrators. Description =========== Samba's Active Directory Domain Controller (AD DC) allows the administrator to delegate creation of user or computer accounts to specific users or groups. Samba's AD DC did not implement the additional required check on the UF_SERVER_TRUST_ACCOUNT bit in the userAccountControl attributes. Most Samba deployments are not of the AD Domain Controller, but are of the classic domain controller, the file server or print server. Only the AD DC is affected by this issue. Additionally, most sites running the AD Domain Controller do not configure delegation for the creation of user or computer accounts, and so are not vulnerable to this issue, as no writes are permitted to the userAccountControl attribute, no matter what the value. Impact ====== Remote authenticated users are able to set the LDB userAccountControl UF_SERVER_TRUST_ACCOUNT bit, and consequently gain privileges, by leveraging delegation of authority for user-account or computer-account creation when an Active Directory Domain Controller (AD DC) is configured. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8143 https://www.samba.org/samba/security/CVE-2014-8143

1 0

[arch-security] [ASA-201501-9] curl: url request injection
by Remi Gacogne 19 Jan '15

19 Jan '15

Arch Linux Security Advisory ASA-201501-9 ========================================= Severity: Low Date : 2015-01-18 CVE-ID : CVE-2014-8150 Package : curl Type : url request injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.40.0-1 is vulnerable to an URL request injection issue when using a HTTP proxy. Resolution ========== Upgrade to 7.40.0-1. # pacman -Syu "curl>=7.40.0-1" The problem has been fixed upstream in version 7.40.0. Workaround ========== Only use URLs that are carefully stripped from line feeds and carriage returns. Description =========== When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL. Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or just to insert request headers into the request that the program didn't intend. Impact ====== A remote attacker may be able to inject arbitrary HTTP headers, or even send a completely new HTTP request by placing CRLF in the URL passed to curl or libcurl. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8150 http://curl.haxx.se/docs/adv_20150108B.html https://bugs.archlinux.org/task/43379

1 0

[arch-security] [ASA-201501-8] flashplugin: multiple issues
by Remi Gacogne 15 Jan '15

15 Jan '15

Arch Linux Security Advisory ASA-201501-8 ========================================= Severity: Critical Date : 2014-01-15 CVE-ID : CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.429-1 is vulnerable to multiple issues, including but not limited to remote code execution. Resolution ========== Upgrade to 11.2.202.429-1. # pacman -Syu "flashplugin>=11.2.202.429-1" The problem has been fixed upstream in version 11.2.202.429. Workaround ========== If an upgrade is not possible, you may want to disable the flashplugin on your system. Description =========== - CVE-2015-0301 Improper file validation issue. - CVE-2015-0302 (information disclosure) Information disclosure vulnerability that could be exploited to capture keystrokes on the affected system. - CVE-2015-0303, CVE-2015-0306 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. - CVE-2015-0304, CVE-2015-0309 (arbitrary code execution) Heap-based buffer overflow vulnerabilities that could lead to code execution - CVE-2015-0305 (arbitrary code execution) Type confusion vulnerability that could lead to code execution. - CVE-2015-0307 (information disclosure) Out-of-bounds read vulnerability that could be exploited to leak memory addresses. - CVE-2015-0308 (arbitrary code execution) Use-after-free vulnerability that could lead to code execution. Impact ====== An attacker able to supply a malicious flash application may be able to capture keystrokes or execute arbitrary code on the affected system. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-01.html https://bugs.archlinux.org/task/43455 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0301 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0302 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0303 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0304 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0305 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0306 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0307 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0308 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0309

1 0

[arch-security] [ASA-201501-7] thunderbird: multiple issues
by Remi Gacogne 14 Jan '15

14 Jan '15

Arch Linux Security Advisory ASA-201501-7 ========================================= Severity: Critical Date : 2015-01-14 CVE-ID : CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 31.4.0-1 is vulnerable to multiple issues, that Mozilla believes not to be exploitable through email. Upgrading is still advised. Resolution ========== Upgrade to 31.4.0-1. # pacman -Syu "thunderbird>=31.4.0-1" The problem has been fixed upstream in version 31.4.0. Workaround ========== None. Description =========== - CVE-2014-8634 (arbitrary remote code execution) Christian Holler and Patrick McManus reported memory safety problems and crashes that affect Firefox ESR 31.3 and Firefox 34. - CVE-2014-8635 (arbitrary remote code execution) Christoph Diehl, Christian Holler, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier reported memory safety problems and crashes that affect Firefox 34. - CVE-2014-8638 (XSRF) Security researcher Muneaki Nishimura reported that navigator.sendBeacon() does not follow the cross-origin resource sharing (CORS) specification. This results in the request from sendBeacon() lacking an origin header in violation of the W3C Beacon specification and not being treated as a CORS request. This allows for a potential Cross-site request forgery (XSRF) attack from malicious websites. - CVE-2014-8639 (cookie injection) Security researcher Xiaofeng Zheng of the Blue Lotus Team at Tsinghua University reported reported that a Web Proxy returning a 407 Proxy Authentication response with a Set-Cookie header could inject cookies into the originally requested domain. This could be used for session-fixation attacks. This attack only allows cookies to be written but does not allow them to be read. Impact ====== Mozilla believes that these issues cannot be exploited by e-mail, either because scripting is disabled or because no HTTP request should be initiated by thunderbird. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8634 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8635 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8638 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8639 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/

1 0

[arch-security] [ASA-201501-6] firefox: multiple issues
by Remi Gacogne 14 Jan '15

14 Jan '15

Arch Linux Security Advisory ASA-201501-6 ========================================= Severity: Critical Date : 2015-01-14 CVE-ID : CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 35.0-1 is vulnerable to multiple issues, including but not limited to remote code execution. Resolution ========== Upgrade to 35.0-1. # pacman -Syu "firefox>=35.0-1" The problem has been fixed upstream in version 35.0. Workaround ========== None. Description =========== - CVE-2014-8634 (arbitrary remote code execution) Christian Holler and Patrick McManus reported memory safety problems and crashes that affect Firefox ESR 31.3 and Firefox 34. - CVE-2014-8635 (arbitrary remote code execution) Christoph Diehl, Christian Holler, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier reported memory safety problems and crashes that affect Firefox 34. - CVE-2014-8636 (arbitrary javascript code execution, privilege escalation) Mozilla developer Bobby Holley reported that Document Object Model (DOM) objects with some specific properties can bypass XrayWrappers. This can allow web content to confuse privileged code, potentially enabling privilege escalation. - CVE-2014-8637 (information leakage) Google security researcher Michal Zalewski reported that when a malformed bitmap image is rendered by the bitmap decoder within a <canvas> element, memory may not always be properly initialized. The resulting image then uses this uninitialized memory during rendering, allowing data to potentially leak to web content. - CVE-2014-8638 (XSRF) Security researcher Muneaki Nishimura reported that navigator.sendBeacon() does not follow the cross-origin resource sharing (CORS) specification. This results in the request from sendBeacon() lacking an origin header in violation of the W3C Beacon specification and not being treated as a CORS request. This allows for a potential Cross-site request forgery (XSRF) attack from malicious websites. - CVE-2014-8639 (cookie injection) Security researcher Xiaofeng Zheng of the Blue Lotus Team at Tsinghua University reported reported that a Web Proxy returning a 407 Proxy Authentication response with a Set-Cookie header could inject cookies into the originally requested domain. This could be used for session-fixation attacks. This attack only allows cookies to be written but does not allow them to be read. - CVE-2014-8640 (denial of service) Security researcher Holger Fuhrmannek used the used the Address Sanitizer tool to discover a crash in Web Audio while manipulating timelines. This allowed for the a small block of memory with an uninitialized pointer to be read. The crash is not exploitable. - CVE-2014-8641 (remote code execution) Security researcher Mitchell Harper discovered a read-after-free in WebRTC due to the way tracks are handled. This results in a either a potentially exploitable crash or incorrect WebRTC behavior. - CVE-2014-8642 (OCSP bypass) Brian Smith reported that delegated Online Certificate Status Protocol (OCSP) responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. If this extension is present in a delegated OCSP response signing certificate, it will be discarded if it is signed by such a certificate. This could result in a user connecting to a site with a revoked certificate. Impact ====== An attacker controlling a malicious website or in position of man-in-the-middle may be able to access sensitive information, exploit existing sessions, crash the browser, or remotely execute arbitrary code. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8634 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8635 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8636 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8637 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8638 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8639 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8640 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8641 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8642 https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/

1 0