December 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201512-19] openvpn: out-of-bound read
by Remi Gacogne 28 Dec '15

28 Dec '15

Arch Linux Security Advisory ASA-201512-19 ========================================== Severity: Low Date : 2015-12-28 CVE-ID : N/A Package : openvpn Type : out-of-bound error Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openvpn before version 2.3.9-1 is vulnerable to an out-of-bound read. Resolution ========== Upgrade to 2.3.9-1. # pacman -Syu "openvpn>=2.3.9-1" The problem has been fixed upstream in version 2.3.9. Workaround ========== None. Description =========== The code always tried to copy-out a "struct sockaddr_in6" even for IPv4 results, which reads more bytes than getaddrinfo() is guaranteed to allocate. Impact ====== A remote attacker might be able to cause a denial of service (application crash) or access sensitive data. References ========== https://bugs.archlinux.org/task/47498 http://seclists.org/oss-sec/2015/q4/535 https://blog.fuzzing-project.org/32-Out-of-bounds-read-in-OpenVPN.html http://permalink.gmane.org/gmane.network.openvpn.devel/10479

1 0

[arch-security] [ASA-201512-18] libpng: buffer overflow
by Remi Gacogne 28 Dec '15

28 Dec '15

Arch Linux Security Advisory ASA-201512-18 ========================================== Severity: High Date : 2015-12-28 CVE-ID : CVE-2015-8472 Package : libpng Type : buffer overflow Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpng before version 1.6.20-1 is vulnerable to a buffer overflow vulnerability, incompletely fixed in version 1.6.19. Resolution ========== Upgrade to 1.6.20-1. # pacman -Syu "libpng>=1.6.20-1" The problem has been fixed upstream in version 1.6.20. Workaround ========== None. Description =========== It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. This issue is the result of an incomplete fix for CVE-2015-8126 in libpng 1.6.19. Impact ====== A remote attacker might be able to execute arbitrary code on the affected by submitting a crafted PNG file to an application calling directly the png_set_PLTE() with invalid palette sizes. References ========== https://access.redhat.com/security/cve/CVE-2015-8472 http://seclists.org/oss-sec/2015/q4/439

1 0

[arch-security] [ASA-201512-17] flashplugin, lib32-flashplugin: multiple issues
by Remi Gacogne 28 Dec '15

28 Dec '15

Arch Linux Security Advisory ASA-201512-17 ========================================== Severity: Critical Date : 2015-12-28 CVE-ID : CVE-2015-8459 CVE-2015-8460 CVE-2015-8634 CVE-2015-8635 CVE-2015-8636 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8644 CVE-2015-8645 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 CVE-2015-8650 CVE-2015-8651 Package : flashplugin, lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages flashplugin and lib32-flashplugin before version 11.2.202.559-1 are vulnerable to multiple issues, including remote code execution. At least one of these vulnerabilities, CVE-2015-8651, has been reported in use for targeted attacks. Resolution ========== Upgrade to 11.2.202.559-1. # pacman -Syu "flashplugin>=11.2.202.559-1" # pacman -Syu "lib32-flashplugin>=11.2.202.559-1" The problem has been fixed upstream in version 11.2.202.559. Workaround ========== None. Description =========== - CVE-2015-8459: Memory corruption vulnerabilities that could lead to code execution. Credited to Kai Kang of Tencent's Xuanwu LAB. - CVE-2015-8460: Memory corruption vulnerabilities that could lead to code execution. Credited to Jie Zeng of Qihoo 360. - CVE-2015-8634, CVE-2015-8635: Use-after-free vulnerabilities that could lead to code execution. Credited to Ben Hawkes, Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2015-8636: Memory corruption vulnerabilities that could lead to code execution. Credited to Ben Hawkes, Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2015-8638, CVE-2015-8639: Use-after-free vulnerabilities that could lead to code execution. Credited to Anonymous working with HP's Zero Day Initiative. - CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646: Use-after-free vulnerabilities that could lead to code execution. Credited to Yuki Chen of Qihoo 360 Vulcan Team. - CVE-2015-8644: Type confusion vulnerability that could lead to code execution. Credited to Natalie Silvanovich of Google Project Zero. - CVE-2015-8645: Memory corruption vulnerabilities that could lead to code execution. Credited to Jaehun Jeong (@n3sk) of WINS, WSEC Analysis Team working with Chromium Vulnerability Reward Program. - CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650: Use-after-free vulnerabilities that could lead to code execution. Credited to Anonymous working with HP's Zero Day Initiative. - CVE-2015-8651: Integer overflow vulnerability that could lead to code execution. Credited to Kai Wang and Hunter Gao of Huawei's IT Infrastructure & Security Dept, BPIT&QM. Adobe is aware of a report that an exploit for CVE-2015-8651 is being used in limited, targeted attacks. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-01.html https://access.redhat.com/security/cve/CVE-2015-8459 https://access.redhat.com/security/cve/CVE-2015-8460 https://access.redhat.com/security/cve/CVE-2015-8634 https://access.redhat.com/security/cve/CVE-2015-8635 https://access.redhat.com/security/cve/CVE-2015-8636 https://access.redhat.com/security/cve/CVE-2015-8638 https://access.redhat.com/security/cve/CVE-2015-8639 https://access.redhat.com/security/cve/CVE-2015-8640 https://access.redhat.com/security/cve/CVE-2015-8641 https://access.redhat.com/security/cve/CVE-2015-8642 https://access.redhat.com/security/cve/CVE-2015-8643 https://access.redhat.com/security/cve/CVE-2015-8644 https://access.redhat.com/security/cve/CVE-2015-8645 https://access.redhat.com/security/cve/CVE-2015-8646 https://access.redhat.com/security/cve/CVE-2015-8647 https://access.redhat.com/security/cve/CVE-2015-8648 https://access.redhat.com/security/cve/CVE-2015-8649 https://access.redhat.com/security/cve/CVE-2015-8650 https://access.redhat.com/security/cve/CVE-2015-8651

1 0

[arch-security] [ASA-201512-16] nghttp2: use-after-free
by Remi Gacogne 25 Dec '15

25 Dec '15

Arch Linux Security Advisory ASA-201512-16 ========================================== Severity: High Date : 2015-12-25 CVE-ID : CVE-2015-8659 Package : nghttp2 Type : use-after-free Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nghttp2 before version 1.6.0-1 is vulnerable to a heap-based use-after-free, leading to denial of service or possibly arbitrary code execution. Resolution ========== Upgrade to 1.6.0-1. # pacman -Syu "nghttp2>=1.6.0-1" The problem has been fixed upstream in version 1.6.0. Workaround ========== None. Description =========== nghttp2 1.6.0 fixes a heap-based use-after-free bug in idle stream handling code, where an idle/closed stream could possibly be destroyed while it was still referenced. Impact ====== A remote attacker could exploit this bug in a HTTP/2 client or server, leading to denial of service or even arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-8659 http://seclists.org/oss-sec/2015/q4/576 https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/ https://github.com/tatsuhiro-t/nghttp2/commit/92a56d034f201cbb609606184822c…

1 0

[arch-security] [ASA-201512-15] mediawiki: multiple issues
by Remi Gacogne 25 Dec '15

25 Dec '15

Arch Linux Security Advisory ASA-201512-15 ========================================== Severity: Medium Date : 2015-12-25 CVE-ID : CVE-2015-8622 CVE-2015-8624 CVE-2015-8625 CVE-2015-8626 CVE-2015-8627 CVE-2015-8628 Package : mediawiki Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mediawiki before version 1.26.2-1 is vulnerable to multiple issues including XSS, timing attack, sensitive information leak, password-policy bypass and IP-blocking bypass. Resolution ========== Upgrade to 1.26.2-1. # pacman -Syu "mediawiki>=1.26.2-1" The problem has been fixed upstream in version 1.26.1. Workaround ========== None. Description =========== - CVE-2015-8622: (T117899) XSS from wikitext when $wgArticlePath='$1'. Internal review discovered an XSS vector when MediaWiki is configured with a non-standard configuration. - CVE-2015-8624: (T119309) User::matchEditToken should use constant-time string comparison. Internal review discovered that tokens were being compared as strings, which could allow a timing attack. - CVE-2015-8625: (T118032) Error thrown by VirtualRESTService when POST variable starts with '@'. Internal review discovered that MediaWiki was not sanitizing parameters passed to the curl library, which could cause curl to upload files from the webserver to an attacker. - CVE-2015-8626: (T115522) Passwords generated by User::randomPassword() may be shorter than $wgMinimalPasswordLength. MediaWiki user Frank R. Farmer reported that the password reset token could be shorter than the minimum required password length. - CVE-2015-8627: (T97897) Incorrect parsing of IPs for global block. Wikimedia steward Vituzzu reported that blocking IP addresses with zero-padded octets resulted in a failure to block the IP address. - CVE-2015-8628: (T109724) A combination of Special:MyPage redirects and pagecounts allows an external site to know the wikipedia login of an user. Wikimedia user Xavier Combelle reported a way to identify user, when detailed page view data is also released. Impact ====== A remote attacker might be able to access sensitive information by tricking the server into uploading file content or by a timing attack. A remote attacker might be able to bypass password policy and IP blocking measures. References ========== http://seclists.org/oss-sec/2015/q4/573 https://phabricator.wikimedia.org/T97897 https://phabricator.wikimedia.org/T109724 https://phabricator.wikimedia.org/T115522 https://phabricator.wikimedia.org/T117899 https://phabricator.wikimedia.org/T118032 https://phabricator.wikimedia.org/T119309 https://access.redhat.com/security/cve/CVE-2015-8622 https://access.redhat.com/security/cve/CVE-2015-8624 https://access.redhat.com/security/cve/CVE-2015-8625 https://access.redhat.com/security/cve/CVE-2015-8626 https://access.redhat.com/security/cve/CVE-2015-8627 https://access.redhat.com/security/cve/CVE-2015-8628

1 0

[arch-security] [ASA-201512-14] thunderbird: multiple issues
by Remi Gacogne 25 Dec '15

25 Dec '15

Arch Linux Security Advisory ASA-201512-14 ========================================== Severity: Critical Date : 2015-12-25 CVE-ID : CVE-2015-7201 CVE-2015-7205 CVE-2015-7212 CVE-2015-7213 CVE-2015-7214 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 38.5.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 38.5.0-1. # pacman -Syu "thunderbird>=38.5.0-1" The problem has been fixed upstream in version 38.5.0. Workaround ========== None. Description =========== - CVE-2015-7201 (cross-origin restriction bypass using data: and view-source: uri scheme): Security researcher Tsubasa Iinuma reported a mechanism to violate same-origin policy to content using data: and view-source: URIs to confuse protections and bypass restrictions. This resulted in the ability to read data from cross-site URLs and local files. - CVE-2015-7205 (overflow in MPEG4Extractor::readMetaData causes memory-safety bug): Security researcher Ronald Crane reported a vulnerability found through code inspection. This issue is an integer overflow while processing an MP4 format video file when an a erroneously-small buffer is allocated and then overrun, resulting in a potentially exploitable crash. - CVE-2015-7212 (underflow in RTPReceiverVideo::ParseRtpPacket causes memory-safety bug and information leak): Security researcher Ronald Crane reported an underflow found through code inspection. This does not all have a clear mechanism to be exploited through web content but could be vulnerable if a means can be found to trigger it. - CVE-2015-7213 (integer overflow allocating extremely large textures): Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an integer overflow when when allocating textures of extremely larges sizes during graphics operations. This results in a potentially exploitable crash when triggered. - CVE-2015-7214 (miscellaneous memory safety hazards): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Andrei Vaida, Jesse Ruderman, and Bob Clary reported memory safety problems and crashes that affect Firefox ESR 38.4 and Firefox 42. Impact ====== A remote attacker might be able to bypass the same-origin policy to access sensitive data, or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://access.redhat.com/security/cve/CVE-2015-7201 https://access.redhat.com/security/cve/CVE-2015-7205 https://access.redhat.com/security/cve/CVE-2015-7212 https://access.redhat.com/security/cve/CVE-2015-7213 https://access.redhat.com/security/cve/CVE-2015-7214

1 0

[arch-security] [ASA-201512-13] claws-mail: buffer overflow
by Remi Gacogne 22 Dec '15

22 Dec '15

Arch Linux Security Advisory ASA-201512-13 ========================================== Severity: High Date : 2015-12-22 CVE-ID : CVE-2015-8614 Package : claws-mail Type : buffer overflow Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package claws-mail before version 3.13.1-1 is vulnerable to a remotely triggerable buffer overflow. Resolution ========== Upgrade to 3.13.1-1. # pacman -Syu "claws-mail>=3.13.1-1" The problem has been fixed upstream in version 3.13.1. Workaround ========== None. Description =========== A remotely triggerable buffer overflow has been found in the code of claws-mail handling character conversion, in functions conv_jistoeuc(), conv_euctojis() and conv_sjistoeuc(), in codeconv.c. There was no bounds checking on buffers passed to these functions, some stack-based but other potentially heap-based. This issue has been located in the wild and might currently be exploited. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host by sending a crafted e-mail to a clasw-mail user. References ========== https://access.redhat.com/security/cve/CVE-2015-8614 http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557 http://git.claws-mail.org/?p=claws.git;a=blobdiff;f=src/codeconv.c;h=39e259…

1 0

[arch-security] [ASA-201512-12] python2-pyamf: XML external entity injection
by Levente Polyak 17 Dec '15

17 Dec '15

Arch Linux Security Advisory ASA-201512-12 ========================================== Severity: Medium Date : 2015-12-17 CVE-ID : CVE-2015-8549 Package : python2-pyamf Type : XML external entity injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-pyamf before version 0.8.0-2 is vulnerable to XML external entity injection. Resolution ========== Upgrade to 0.8.0-2. # pacman -Syu "python2-pyamf>=0.8.0-2" The problem has been fixed upstream in version 0.8.0 Workaround ========== None. Description =========== PyAMF suffers from insufficient AMF input payload sanitization which results in the XML parser not preventing the processing of XML external entities (XXE). A specially crafted AMF payload, containing malicious references to XML external entities, can be used to trigger denial of service (DoS) conditions or arbitrarily return the contents of files that are accessible with the running application privileges. Impact ====== A remote attacker is able to craft special XML files that, when processed, are injecting external entities resulting in denial of service of disclosure of arbitrary file contents. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8549 http://www.ocert.org/advisories/ocert-2015-011.html https://github.com/hydralabs/pyamf/pull/58

1 0

[arch-security] [ASA-201512-11] ruby: unsafe tainted string usage
by Levente Polyak 17 Dec '15

17 Dec '15

Arch Linux Security Advisory ASA-201512-11 ========================================== Severity: Low Date : 2015-12-17 CVE-ID : CVE-2015-7551 Package : ruby Type : unsafe tainted string usage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ruby before version 2.2.4-1 is vulnerable to unsafe tainted string usage. Resolution ========== Upgrade to 2.2.4-1. # pacman -Syu "ruby>=2.2.4-1" The problem has been fixed upstream in version 2.2.4. Workaround ========== None. Description =========== There is an unsafe tainted string vulnerability in Fiddle and DL. This issue was originally reported and fixed with CVE-2009-5147 in DL, but reappeared after DL was reimplemented using Fiddle and libffi. Impact ====== A remote attacker is able to open a library via Fiddle with tainted library name if passed from an untrusted input. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7551 https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in…

1 0

Re: [arch-security] [CVE-2015-8370] Grub2 Authentication (Back to 28)
by Levente Polyak 16 Dec '15

16 Dec '15

On 12/16/2015 07:55 PM, Ivan wrote: > A recent vulnerability has been discovered, affecting GRUB from > versions 1.98 to 2.02. > > More info: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html > Hey Ivan, an updated GRUB version is already laying in testing and awaits sign-offs [0]. Thanks anyway for reporting, however if you just want to make sure it gets handled and we are aware of the issue, feel free to instead simply join the IRC channel #archlinux-security on freenode and drop us a message there. cheers, Levente [0] https://www.archlinux.org/packages/testing/x86_64/grub/

1 0