October 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-6] gdk-pixbuf2: multiple issues
by Levente Polyak 10 Oct '15

10 Oct '15

Arch Linux Security Advisory ASA-201510-6 ========================================= Severity: Medium Date : 2015-10-10 CVE-ID : CVE-2015-7673 CVE-2015-7674 Package : gdk-pixbuf2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gdk-pixbuf2 before version 2.32.1-1 is vulnerable to denial of service and heap buffer overflow. Resolution ========== Upgrade to 2.32.1-1. # pacman -Syu "gdk-pixbuf2>=2.32.1-1" The problems have been fixed upstream in version 2.32.1. Workaround ========== None. Description =========== - CVE-2015-7673 (denial of service) It has been discovered that under certain circumstances while scaling a tga file a heap memory allocation may fail which is later used and leads to a denial of service. - CVE-2015-7673 (heap buffer overflow) It has been discovered that under certain circumstances while scaling a gif file a heap buffer overflow can occur. The cause of this issue was that the integer data type was incompatible with the details of how bitwise shifts were used. Impact ====== A remote attacker is able to use specially crafted tga or gif files to perform a denial of service attack or take advantage of a heap buffer overflow to possibly have other impact. References ========== https://access.redhat.com/security/cve/CVE-2015-7673 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7674 http://seclists.org/oss-sec/2015/q4/18 http://seclists.org/oss-sec/2015/q4/19

1 0

[arch-security] [ASA-201510-5] opensmtpd: multiple issues
by Levente Polyak 08 Oct '15

08 Oct '15

Arch Linux Security Advisory ASA-201510-5 ========================================= Severity: Critical Date : 2015-10-08 CVE-ID : CVE-2015-7687 Package : opensmtpd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package opensmtpd before version 5.7.3p1-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 5.7.3p1-1. # pacman -Syu "opensmtpd>=5.7.3p1-1" The problems have been fixed upstream in version 5.7.3p1. Workaround ========== None. Description =========== - an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory - multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD - a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user - a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files - a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd) - a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition - an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection - a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user - fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda - fix remote buffer overflow in unprivileged pony process - reworked offline enqueue to better protect against hardlink attacks Impact ====== A remote attacker is able to execute arbitrary code, crash the process to perform a denial of service attack, read arbitrary memory to disclose information and defeat ASLR or have other unspecified impact via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7687 https://www.opensmtpd.org/announces/release-5.7.2.txt https://www.opensmtpd.org/announces/release-5.7.3.txt http://seclists.org/oss-sec/2015/q4/17 https://bugs.archlinux.org/task/46605

1 0

[arch-security] [ASA-201510-4] bugzilla: unauthorized account creation
by Levente Polyak 08 Oct '15

08 Oct '15

Arch Linux Security Advisory ASA-201510-4 ========================================= Severity: High Date : 2015-10-08 CVE-ID : CVE-2015-4499 Package : bugzilla Type : unauthorized account creation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bugzilla before version 5.0.1-1 is vulnerable to unauthorized account creation. Resolution ========== Upgrade to 5.0.1-1. # pacman -Syu "bugzilla>=5.0.1-1" The problem has been fixed upstream in version 5.0.1. Workaround ========== None. Description =========== Login names (usually an email address) longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested. The login name could then be automatically added to groups based on the group's regular expression setting. This vulnerability has been demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address that resulted in an unauthorized account creation with the default privileges of the mozilla group. Impact ====== A remote attacker is able to obtain default privileges for an arbitrary domain name by placing that name in a substring of an address resulting in unauthorized account creation. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4499 https://www.bugzilla.org/security/4.2.14/ https://bugzilla.mozilla.org/show_bug.cgi?id=1202447 https://bugs.archlinux.org/task/46573

1 0

[arch-security] [ASA-201510-3] nodejs: denial of service
by Levente Polyak 06 Oct '15

06 Oct '15

Arch Linux Security Advisory ASA-201510-3 ========================================= Severity: Medium Date : 2015-10-06 CVE-ID : CVE-2015-7384 Package : nodejs Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nodejs before version 4.1.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.2-1. # pacman -Syu "nodejs>=4.1.2-1" The problem has been fixed upstream in version 4.1.2. Workaround ========== None. Description =========== A vulnerability has been discovered in the HTTP pipeline handling that is leading to an application crash. This problem is caused by out-of-order responses being sent to the client within a single pipelined connection. Impact ====== A remote attacker is able to crash the process when out-of-order responses are sent within a single pipelined connection resulting in denial of service. References ========== https://github.com/nodejs/node/issues/3138 https://access.redhat.com/security/cve/CVE-2015-7384 https://nodejs.org/en/blog/release/v4.1.2/

1 0

[arch-security] [ASA-201510-2] hostapd: denial of service
by Christian Rebischke 05 Oct '15

05 Oct '15

Arch Linux Security Advisory ASA-201510-2 ========================================= Severity: Medium Date : 2015-10-05 CVE-ID : CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146 Package : hostapd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package hostapd before version 2.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.5-1 # pacman -Syu "hostapd>=2.5-1" The problem has been fixed upstream in version 2.5. Workaround ========== None. Description =========== - CVE-2015-4141 (denial of service) A vulnerability was found in the WPS UPnP function shared by hostapd (WPS AP) and wpa_supplicant (WPS external registrar). This may allow a possible denial of service attack through - CVE-2015-4142 (denial of service) A vulnerability was found in WMM Action frame processing in a case where hostapd or wpa_supplicant is used to implement AP mode MLME/SME functionality (i.e., Host AP driver of a mac80211-based driver on Linux). This vulnerability can be used to perform denial of service attacks by an attacker that is within radio range of the AP that uses hostapd of wpa_supplicant for MLME/SME operations. - CVE-2015-4143 (denial of service) The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload. - CVE-2015-4144 (denial of service) The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message. - CVE-2015-4145 (denial of service) The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message. - CVE-2015-4146 (denial of service) The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message. Impact ====== A remote attacker is able to crash the wifi access point. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4141 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4142 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4143 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4144 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4145 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4146 http://w1.fi/security/2015-2/ http://w1.fi/security/2015-3/ http://w1.fi/security/2015-4/ http://w1.fi/security/2015-5/

1 0

[arch-security] [ASA-201510-1] libunwind: denial of service
by Christian Rebischke 05 Oct '15

05 Oct '15

Arch Linux Security Advisory ASA-201510-1 ========================================= Severity: Low Date : 2015-10-05 CVE-ID : CVE-2015-3239 Package : libunwind Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libunwind before version 1.1-3 is vulnerable to denial of service due to an off-by-one error. Resolution ========== Upgrade to 1.1-3. # pacman -Syu "libunwind>=1.1-3" Workaround ========== None. Description =========== - CVE-2015-3239 (Unspecified Impact): Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes. Impact ====== An attacker could crash the library. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3239 https://bugzilla.redhat.com/show_bug.cgi?id=1232265 https://bugs.archlinux.org/task/46474

1 0