October 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-16] jre7-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-16 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u91_2.6.2-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 7.u91_2.6.2-1. # pacman -Syu "jre7-openjdk>=7.u91_2.6.2-1" The problems have been fixed upstream in version 7.u91. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4871 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-October/033972.h… http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4911

1 0

[arch-security] [ASA-201510-15] jdk7-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-15 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u91_2.6.2-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 7.u91_2.6.2-1. # pacman -Syu "jdk7-openjdk>=7.u91_2.6.2-1" The problems have been fixed upstream in version 7.u91. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4871 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-October/033972.h… http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4911

1 0

[arch-security] [ASA-201510-14] ntp: multiple issues
by Christian Rebischke 22 Oct '15

22 Oct '15

Arch Linux Security Advisory ASA-201510-14 ========================================== Severity: Critical Date : 2015-10-22 CVE-ID : CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p4-1 is vulnerable to multiple issues including denial of service, memory corruption, directory traversal, memory leaks and authentication bypass. Resolution ========== Upgrade to 4.2.8.p4-1. # pacman -Syu "ntp>=4.2.8.p4-1" The problems have been fixed upstream in version 4.2.8.p4. Workaround ========== None. Description =========== - CVE-2015-7871 (authentication bypass) An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is credited with discovering this vulnerability. [1] - CVE-2015-7855 (denial of service) decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values. This can cause a denial of service. - CVE-2015-7854 (memory corruption) A potential buffer overflow vulnerability exists in the password management functionality of ntp. A specially crafted key file could cause a buffer overflow potentially resulting in memory being modified. An attacker could provide a malicious password to trigger this vulnerability. [2] - CVE-2015-7849 (memory corruption) An exploitable use-after-free vulnerability exists in the password management functionality of the Network Time Protocol. A specially crafted key file could cause a buffer overflow resulting in memory corruption. An attacker could provide a malicious password file to trigger this vulnerability. [3] - CVE-2015-7852 (memory corruption) A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. [4] - CVE-2015-7853 (memory corruption) A potential buffer overflow vulnerability exists in the refclock of ntpd. An invalid length provided by a hardware reference clock could cause a buffer overflow potentially resulting in memory being modified. A malicious reflock could provide a negative length to trigger this vulnerability. [5] - CVE-2015-7848 (denial of service) When processing a specially crafted private mode packet, an integer overflow can occur leading to out of bounds memory copy operation. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash. [6] - CVE-2015-7850 (denial of service) An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability. [7] - CVE-2015-7851 (directory traversal) A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability. [8] - CVE-2015-7701 (memory leak) Slow memory leak in CRYPTO_ASSOC. - CVE-2015-7702 (denial of service). Incomplete autokey data packet length checks. - CVE-2015-7703 (directory traversal) configuration directives "pidfile" and "driftfile" should only be allowed locally. - CVE-2015-7704 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7705 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7691 (denial of service) Incomplete autokey data packet length checks. - CVE-2015-7692 (denial of service Incomplete autokey data packet length checks. Impact ====== A remote attacker is able to crash the NTP-Server, change the system time, overwrite configuration file or can corrupt the memory. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities http://blog.talosintel.com/2015/10/ntpd-vulnerabilities.html http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7691 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7692 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7701 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7702 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7703 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7704 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7705 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7848 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7849 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7850 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7851 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7852 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7853 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7854 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7855 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7871 [1] http://talosintel.com/reports/TALOS-2015-0069/ [2] http://talosintel.com/reports/TALOS-2015-0065/ [3] http://talosintel.com/reports/TALOS-2015-0054/ [4] http://talosintel.com/reports/TALOS-2015-0063/ [5] http://talosintel.com/reports/TALOS-2015-0064/ [6] http://talosintel.com/reports/TALOS-2015-0052/ [7] http://talosintel.com/reports/TALOS-2015-0055/ [8] http://talosintel.com/reports/TALOS-2015-0062/

1 0

[arch-security] [ASA-201510-13] spice: multiple issues
by Remi Gacogne 19 Oct '15

19 Oct '15

Arch Linux Security Advisory ASA-201510-13 ========================================== Severity: High Date : 2015-10-19 CVE-ID : CVE-2015-3247 CVE-2015-5260 CVE-2015-5261 Package : spice Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package spice before version 0.12.6-1 is vulnerable to multiple issues, including denial of service and privilege escalation. Resolution ========== Upgrade to 0.12.6-1. # pacman -Syu "spice>=0.12.6-1" The problem has been fixed upstream in version 0.12.6. Workaround ========== None. Description =========== - CVE-2015-3247 (race condition flaw): A race condition flaw was found in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5260 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way spice handled certain QXL commands related to the "surface_id" parameter. A user in a guest could use this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5261 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host. Impact ====== A rogue guest user can cause a denial of service to the host or execute arbitrary command with the privileges of the host QEMU-KVM process. References ========== https://bugs.archlinux.org/task/46738 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3247 https://access.redhat.com/security/cve/CVE-2015-5260 https://access.redhat.com/security/cve/CVE-2015-5261 http://lists.freedesktop.org/archives/spice-devel/2015-October/022168.html

1 0

[arch-security] [ASA-201510-12] flashplugin: arbitrary code execution
by Remi Gacogne 18 Oct '15

18 Oct '15

Arch Linux Security Advisory ASA-201510-12 ========================================== Severity: Critical Date : 2015-10-18 CVE-ID : CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.540-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.540-1. # pacman -Syu "flashplugin>=11.2.202.540-1" The problem has been fixed upstream in version 11.2.202.540. Workaround ========== None. Description =========== Several critical type confusion vulnerabilities (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648) have been identified in Adobe Flash Player 11.2.202.535 and earlier 11.x versions for Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for the CVE-2015-7645 vulnerability is being used in limited, targeted attacks. Impact ====== A remote attacker can execute arbitrary code by supplying a crafted SWF flash file on a website. These vulnerabilities are currently exploited in the wild. References ========== https://helpx.adobe.com/security/products/flash-player/apsa15-05.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7645

1 0

[arch-security] [ASA-201510-11] miniupnpc: arbitrary code execution
by Levente Polyak 18 Oct '15

18 Oct '15

Arch Linux Security Advisory ASA-201510-11 ========================================== Severity: Critical Date : 2015-10-18 CVE-ID : CVE-2015-6031 Package : miniupnpc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package miniupnpc before version 1.9.20151008-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9.20151008-1. # pacman -Syu "miniupnpc>=1.9.20151008-1" The problem has been fixed upstream but no release is available. Workaround ========== None. Description =========== An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability. Impact ====== A remote attacker is able to create a specially crafted XML response on a server set up on the local network to execute arbitrary code on the client. References ========== http://talosintel.com/reports/TALOS-2015-0035/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6031 https://bugs.archlinux.org/task/46612

1 0

[arch-security] [ASA-201510-10] firefox: cross-origin restriction bypass
by Remi Gacogne 16 Oct '15

16 Oct '15

Arch Linux Security Advisory ASA-201510-10 ========================================== Severity: High Date : 2015-10-16 CVE-ID : CVE-2015-7184 Package : firefox Type : cross-origin restriction bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 41.0.2-1 is vulnerable to cross-origin restriction bypass. Resolution ========== Upgrade to 41.0.2-1. # pacman -Syu "firefox>=41.0.2-1" The problem has been fixed upstream in version 41.0.2. Workaround ========== None. Description =========== Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue. Impact ====== A remote attacker can bypass the cross-origin resource sharing policy to access sensitive information. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7184

1 0

[arch-security] [ASA-201510-9] mbedtls: arbitrary code execution
by Remi Gacogne 15 Oct '15

15 Oct '15

Arch Linux Security Advisory ASA-201510-9 ========================================= Severity: Critical Date : 2015-10-15 CVE-ID : CVE-2015-5291 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mbedtls before version 2.1.2-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "mbedtls>=2.1.2-1" The problem has been fixed upstream in versions 2.1.2, 1.3.14 and 1.2.17. Workaround ========== To be protected against this vulnerability, you need to apply both of the following work-arounds: - Do not use ticket-based session resumption. This can be achieved in two ways: (1) do not attempt to resume a saved session (do not use mbedtls_get_session() / mbedtls_set_session()), or (2) if you want to resume sessions, make sure you're not using tickets by calling ssl_set_session_tickets( SSL_SESSION_TICKETS_DISABLED ) in 1.3.x or mbedtls_ssl_conf_session_tickets( MBEDTLS_SSL_SESSION_TICKETS_DISABLED ) in 2.x. - If you accept hostnames from untrusted parties, validate that they are at most 255 bytes long (limit defined by RFC 1305) before passing them to ssl_set_hostname(). Description =========== When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension. Starting with PolarSSL 1.3.0 which added support for session tickets, any server the client connects to can send an overlong session ticket which will cause a buffer overflow if and when the client attempts to resume the connection with the server. Clients that disabled session tickets or never attempt to reconnect to a server using a saved session are not vulnerable to this attack vector. Starting with PolarSSL 1.0.0, this overflow could also be triggered by an attacker convincing a client to use an overlong hostname for the SNI extension. The hostname needs to be almost as long at SSL_MAX_CONTENT_LEN, which as 16KB by default, but could be smaller if a custom configuration is used. Clients that do not accept hostnames from untrusted parties are not vulnerable to this attack vector. Impact ====== A malicious server could cause a denial of service or execute arbitrary code on a vulnerable client by sending an overlong session ticket. An attacker could cause a denial of service or execute arbitrary code on a vulnerable client by convincing it to connect to an overlong hostname. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://access.redhat.com/security/cve/CVE-2015-5291

1 0

[arch-security] [ASA-201510-8] chromium: multiple issues
by Remi Gacogne 14 Oct '15

14 Oct '15

Arch Linux Security Advisory ASA-201510-8 ========================================= Severity: High Date : 2015-10-14 CVE-ID : CVE-2015-6755 CVE-2015-6756 CVE-2015-6757 CVE-2015-6758 CVE-2015-6759 CVE-2015-6760 CVE-2015-6761 CVE-2015-6762 CVE-2015-6763 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 46.0.2490.71-1 is vulnerable to multiple issues including but not limited to cross-origin bypass, information leakage and denial of service. Resolution ========== Upgrade to 46.0.2490.71-1. # pacman -Syu "chromium>=46.0.2490.71-1" The problem has been fixed upstream in version 46.0.2490.71. Workaround ========== None. Description =========== - CVE-2015-6755 (cross-origin bypass): Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2015-6756 (use-after-free): Use-after-free in PDFium. - CVE-2015-6757 (use-after-free): Use-after-free in ServiceWorker. Credit to Collin Payne. - CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG. - CVE-2015-6759 (information leakage): Information leakage in LocalStorage. Credit to Muneaki Nishimura (nishimunea). - CVE-2015-6760 (improper error handling): Improper error handling in libANGLE. Credit to lastland.net. - CVE-2015-6761 (memory corruption): Memory corruption in FFMpeg. Credit to Aki Helin of OUSPG and anonymous. - CVE-2015-6762 (cross-origin resource sharing bypass): CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea). - CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the cross-origin restrictions, get access to sensitive information, cause a denial of service or possibly have unspecified other impact. References ========== http://googlechromereleases.blogspot.fr/2015/10/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-6755 https://access.redhat.com/security/cve/CVE-2015-6756 https://access.redhat.com/security/cve/CVE-2015-6757 https://access.redhat.com/security/cve/CVE-2015-6758 https://access.redhat.com/security/cve/CVE-2015-6759 https://access.redhat.com/security/cve/CVE-2015-6760 https://access.redhat.com/security/cve/CVE-2015-6761 https://access.redhat.com/security/cve/CVE-2015-6762 https://access.redhat.com/security/cve/CVE-2015-6763

1 0

[arch-security] [ASA-201510-7] flashplugin: multiple issues
by Levente Polyak 14 Oct '15

14 Oct '15

Arch Linux Security Advisory ASA-201510-7 ========================================= Severity: Critical Date : 2015-10-14 CVE-ID : CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.535-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, same-origin-policy bypass and information disclosure. Resolution ========== Upgrade to 11.2.202.535-1. # pacman -Syu "flashplugin>=11.2.202.535-1" The problems have been fixed upstream in version 11.2.202.535. Workaround ========== None. Description =========== - CVE-2015-5569 (information leak, insufficient hardening) These updates include a defense-in-depth feature in the Flash broker API. - CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7630 CVE-2015-7633 CVE-2015-7634 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2015-7628 (same-origin-policy bypass, information disclosure) These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure. - CVE-2015-7629 CVE-2015-7631 CVE-2015-7643 CVE-2015-7644 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2015-7632 (arbitrary code execution) These updates resolve a buffer overflow vulnerability that could lead to code execution. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same-origin-policy and disclose sensitive information via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://helpx.adobe.com/security/products/flash-player/apsb15-25.html

1 0