December 2015 - Arch-security - lists.archlinux.org

[arch-security] [CVE-2015-8370] Grub2 Authentication (Back to 28)
by Ivan 16 Dec '15

16 Dec '15

A recent vulnerability has been discovered, affecting GRUB from versions 1.98 to 2.02. More info: http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html

1 0

[arch-security] [ASA-201512-10] bind: denial of service
by Levente Polyak 16 Dec '15

16 Dec '15

Arch Linux Security Advisory ASA-201512-10 ========================================== Severity: High Date : 2015-12-16 CVE-ID : CVE-2015-8000 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P2-1. # pacman -Syu "bind>=9.10.3.P2-1" The problem has been fixed upstream in version 9.10.3.P2. Workaround ========== None. Description =========== An error in the parsing of incoming responses allows some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. Intentional exploitation of this condition is possible and could be used as a denial-of-service vector against servers performing recursive queries. An attacker who can cause a server to request a record with a malformed class attribute can use this bug to trigger a REQUIRE assertion in db.c, causing named to exit and denying service to clients. The risk to recursive servers is high. Authoritative servers are at limited risk if they perform authentication when making recursive queries to resolve addresses for servers listed in NS RRSETs. Impact ====== A remote attacker is able to send specially crafted packets to crash the bind process leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2015-8000 https://kb.isc.org/article/AA-01317

1 0

[arch-security] [ASA-201512-9] firefox: multiple issues
by Levente Polyak 16 Dec '15

16 Dec '15

Arch Linux Security Advisory ASA-201512-9 ========================================= Severity: Critical Date : 2015-12-15 CVE-ID : CVE-2015-7201 CVE-2015-7202 CVE-2015-7203 CVE-2015-7204 CVE-2015-7205 CVE-2015-7207 CVE-2015-7208 CVE-2015-7210 CVE-2015-7211 CVE-2015-7212 CVE-2015-7213 CVE-2015-7214 CVE-2015-7215 CVE-2015-7216 CVE-2015-7217 CVE-2015-7218 CVE-2015-7219 CVE-2015-7220 CVE-2015-7221 CVE-2015-7222 CVE-2015-7223 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 43.0-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service, information disclosure, same-origin policy bypass, cookie injection, URL spoofing and privilege escalation. Resolution ========== Upgrade to 43.0-1. # pacman -Syu "firefox>=43.0-1" The problems have been fixed upstream in version 43.0. Workaround ========== None. Description =========== - CVE-2015-7201 CVE-2015-7202 (arbitrary code execution) Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2015-7203 CVE-2015-7220 CVE-2015-7221 (buffer overflow) Security researcher Ronald Crane reported three buffer overflows affecting released code that were found through code inspection. They do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. - CVE-2015-7204 (denial of service) Security researcher Cajus Pollmeier reported crashing during some Javascript variable assignments. The issue was caused by an implementation error with unboxed objects and property storing in the JavaScript engine. This error could result in a potentially exploitable crash when triggered by JavaScript content as well as leading to errors on some websites. - CVE-2015-7205 (information disclosure) Security researcher Ronald Crane reported an underflow found through code inspection. This does not all have a clear mechanism to be exploited through web content but could be vulnerable if a means can be found to trigger it. - CVE-2015-7207 (same-origin policy bypass) Security researcher cgvwzq reported that it is possible to read cross-origin URLs following a redirect if perfomance.getEntries() is used along with an iframe to host a page. Navigating back in history through script, content is pulled from the browser cache for the redirected location instead of going to the original location. This is a same-origin policy violation and could allow for data theft. - CVE-2015-7208 (cookie injection) Security researcher musicDespiteEverything reported an issue when ASCII code 11 for vertical tab is stored in a cookie in violation of RFC6265. This may result in incorrect cookie handling by servers, resulting in the potential ability to set cookie values and read cookie data from users in concert with some web servers if the vertical tab character is mishandled during parsing. - CVE-2015-7210 (arbitrary code execution) Security researcher Looben Yang reported a use-after-free error in WebRTC that occurs due to timing issues in WebRTC when closing channels. WebRTC may still believe is has a datachannel open after another WebRTC function has closed it. This results in attempts to use the now destroyed datachannel, leading to a potentially exploitable crash. - CVE-2015-7211 (URL spoofing) Security researcher Abdulrahman Alqabandi reported that when a data: URI is parsed, the hash ('#') symbol is incorrectly handled, allowing for spoofing attacks. This issue could result in the wrong URI being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. - CVE-2015-7212 (denial of service) Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an integer overflow when when allocating textures of extremely larges sizes during graphics operations. This results in a potentially exploitable crash when triggered. - CVE-2015-7213 (denial of service) Security researcher Ronald Crane reported a vulnerability found through code inspection. This issue is an integer overflow while processing an MP4 format video file when an a erroneously-small buffer is allocated and then overrun, resulting in a potentially exploitable crash. - CVE-2015-7214 (cross-origin restriction bypass) Security researcher Tsubasa Iinuma reported a mechanism to violate same-origin policy to content using data: and view-soure: URIs to confuse protections and bypass restrictions. This resulted in the ability to read data from cross-site URLs and local files. - CVE-2015-7215 (information disclosure) Security researcher Masato Kinugawa reported a cross-origin information leak through the error events in web workers. This violates same-origin policy and the leaked information could potentially be used by a malicious party to gather authentication tokens and other data from third-party websites. - CVE-2015-7216 CVE-2015-7217 (denial of service) Security researcher Gustavo Grieco reported that on Linux Gnome systems the dialog for choosing local files uses the operating system's gdk-pixbuf library to render thumbnails for image file types. This library supports various image decoders, and Grieco reported that the Jasper and TGA decoders were unmaintained and have several known vulnerabilities. Firefox has disabled the use of those decoders in gdk-pixbuf. - CVE-2015-7218 CVE-2015-7219 (denial of service) Security researcher Stuart Larsen reported two issues with HTTP/2 resulting in integer underflows that lead to intentional aborts when the errors are detected. In the first issue, if a malformed HTTP2 header frame is received with only a single byte, an integer underflow can be created in some circumstances. In the second issue, a malformed HTTP2 PushPromse frame is received and the length of the decompressed buffer is miscalculated, leading to another integer underflow. In both of these instances, more memory is allocated than is allowed, triggering assertions and intentional aborts (a denial of service) but no exploitable crashes. - CVE-2015-7222 (denial of service) Mozilla developer Gerald Squelart fixed an integer underflow in the libstagefright library initially reported by Joshua Drake to Google. The issues occurred in MP4 format video file while parsing cover metadata, leading to a buffer overflow. This results in a potentially exploitable crash and can be triggered by a malformed MP4 file served by web content. - CVE-2015-7223 (privilege escalation) Mozilla developer Kris Maglione reported a mechanism where WebExtension APIs could be used to escalate privilege. This could allow arbitrary web content to execute code with the privileges of a particular WebExtension when using these API calls. Depending on the privileges of the extension used, this could result in personal information theft and cross-site scripting (XSS) attacks, including theft of browser cookies. This is mitigated by the requirement to have a WebExtension installed that is vulnerable to this issue. Impact ====== A remote attacker is able execute arbitrary code, perform a denial of service attack, obtain sensitive information and files, bypass the same-origin policy, inject arbitrary cookies, spoof the displayed URL and escalation privileges via various vectors. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7201 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7202 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7203 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7204 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7205 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7207 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7208 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7210 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7211 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7212 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7213 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7214 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7215 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7216 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7217 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7218 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7219 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7220 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7221 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7222 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7223

1 0

[arch-security] [ASA-201512-8] keepassx: information disclosure
by Levente Polyak 10 Dec '15

10 Dec '15

Arch Linux Security Advisory ASA-201512-8 ========================================= Severity: Medium Date : 2015-12-10 CVE-ID : CVE-2015-8378 Package : keepassx Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package keepassx before version 0.4.4-1 is vulnerable to information disclosure via unintended export of plaintext credentials. Resolution ========== Upgrade to 0.4.4-1. # pacman -Syu "keepassx>=0.4.4-1" The problem has been fixed upstream in version 0.4.4. Workaround ========== None. Description =========== It was found that XML export function creates hidden XML file containing user passwords in plaintext without warning, when the export is canceled, which may go unnoticed by the user. In this case the password database was exported as the file “.xml” in the current working directory (often $HOME or the directory of the database) and is world readable. Impact ====== A local attacker can get access to secret plaintext credentials via an unintentionally exported world readable password database. References ========== https://access.redhat.com/security/cve/CVE-2015-8378 https://www.keepassx.org/news/2015/12/551

1 0

[arch-security] [ASA-201512-7] flashplugin: multiple issues
by Levente Polyak 09 Dec '15

09 Dec '15

Arch Linux Security Advisory ASA-201512-7 ========================================= Severity: Critical Date : 2015-12-09 CVE-ID : CVE-2015-8045 CVE-2015-8047 CVE-2015-8048 CVE-2015-8049 CVE-2015-8050 CVE-2015-8055 CVE-2015-8056 CVE-2015-8057 CVE-2015-8058 CVE-2015-8059 CVE-2015-8060 CVE-2015-8061 CVE-2015-8062 CVE-2015-8063 CVE-2015-8064 CVE-2015-8065 CVE-2015-8066 CVE-2015-8067 CVE-2015-8068 CVE-2015-8069 CVE-2015-8070 CVE-2015-8071 CVE-2015-8401 CVE-2015-8402 CVE-2015-8403 CVE-2015-8404 CVE-2015-8405 CVE-2015-8406 CVE-2015-8407 CVE-2015-8408 CVE-2015-8409 CVE-2015-8410 CVE-2015-8411 CVE-2015-8412 CVE-2015-8413 CVE-2015-8414 CVE-2015-8415 CVE-2015-8416 CVE-2015-8417 CVE-2015-8418 CVE-2015-8419 CVE-2015-8420 CVE-2015-8421 CVE-2015-8422 CVE-2015-8423 CVE-2015-8424 CVE-2015-8425 CVE-2015-8426 CVE-2015-8427 CVE-2015-8428 CVE-2015-8429 CVE-2015-8430 CVE-2015-8431 CVE-2015-8432 CVE-2015-8433 CVE-2015-8434 CVE-2015-8435 CVE-2015-8436 CVE-2015-8437 CVE-2015-8438 CVE-2015-8439 CVE-2015-8440 CVE-2015-8441 CVE-2015-8442 CVE-2015-8443 CVE-2015-8444 CVE-2015-8445 CVE-2015-8446 CVE-2015-8447 CVE-2015-8448 CVE-2015-8449 CVE-2015-8450 CVE-2015-8451 CVE-2015-8452 CVE-2015-8453 CVE-2015-8454 CVE-2015-8455 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.554-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, security restriction bypass, denial of service and possibly other unspecified impact. Resolution ========== Upgrade to 11.2.202.554-1. # pacman -Syu "flashplugin>=11.2.202.554-1" The problems have been fixed upstream in version 11.2.202.554. Workaround ========== None. Description =========== - CVE-2015-8045 CVE-2015-8060 CVE-2015-8408 CVE-2015-8416 CVE-2015-8417 CVE-2015-8418 CVE-2015-8419 CVE-2015-8443 CVE-2015-8444 CVE-2015-8047 CVE-2015-8451 CVE-2015-8455 (arbitrary code execution) Memory corruption vulnerabilities have been discovered that could lead to arbitrary code execution. - CVE-2015-8438 CVE-2015-8446 (arbitrary code execution) Heap buffer overflow vulnerabilities have been discovered that could lead to arbitrary code execution. - CVE-2015-8409 CVE-2015-8440 CVE-2015-8453 (security restriction bypass) Multiple issues have been discovered that are lading to security restriction bypass. - CVE-2015-8407 (arbitrary code execution) A stack overflow vulnerability has been discovered that could lead to arbitrary code execution. - CVE-2015-8439 (arbitrary code execution) A type confusion vulnerability has been discovered that could lead to arbitrary code execution. - CVE-2015-8445 (arbitrary code execution) An integer overflow vulnerability has been discovered that could lead to arbitrary code execution. - CVE-2015-8415 (arbitrary code execution) A buffer overflow vulnerability has been discovered that could lead to arbitrary code execution. - CVE-2015-8050 CVE-2015-8049 CVE-2015-8437 CVE-2015-8450 CVE-2015-8449 CVE-2015-8448 CVE-2015-8436 CVE-2015-8452 CVE-2015-8048 CVE-2015-8413 CVE-2015-8412 CVE-2015-8410 CVE-2015-8411 CVE-2015-8424 CVE-2015-8422 CVE-2015-8420 CVE-2015-8421 CVE-2015-8423 CVE-2015-8425 CVE-2015-8433 CVE-2015-8432 CVE-2015-8431 CVE-2015-8426 CVE-2015-8430 CVE-2015-8427 CVE-2015-8428 CVE-2015-8429 CVE-2015-8434 CVE-2015-8435 CVE-2015-8414 CVE-2015-8454 CVE-2015-8059 CVE-2015-8058 CVE-2015-8055 CVE-2015-8057 CVE-2015-8056 CVE-2015-8061 CVE-2015-8067 CVE-2015-8066 CVE-2015-8062 CVE-2015-8068 CVE-2015-8064 CVE-2015-8065 CVE-2015-8063 CVE-2015-8405 CVE-2015-8404 CVE-2015-8402 CVE-2015-8403 CVE-2015-8071 CVE-2015-8401 CVE-2015-8406 CVE-2015-8069 CVE-2015-8070 CVE-2015-8441 CVE-2015-8442 CVE-2015-8447 (arbitrary code execution) Multiple use-after-free vulnerabilities have been discovered that could lead to arbitrary code execution. Impact ====== A remote attacker is able to create a specially crafted SWF file that, when played, is leading to arbitrary code execution, denial of service, security restriction bypass or possibly other unspecified impact via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-8045 https://access.redhat.com/security/cve/CVE-2015-8047 https://access.redhat.com/security/cve/CVE-2015-8048 https://access.redhat.com/security/cve/CVE-2015-8049 https://access.redhat.com/security/cve/CVE-2015-8050 https://access.redhat.com/security/cve/CVE-2015-8055 https://access.redhat.com/security/cve/CVE-2015-8056 https://access.redhat.com/security/cve/CVE-2015-8057 https://access.redhat.com/security/cve/CVE-2015-8058 https://access.redhat.com/security/cve/CVE-2015-8059 https://access.redhat.com/security/cve/CVE-2015-8060 https://access.redhat.com/security/cve/CVE-2015-8061 https://access.redhat.com/security/cve/CVE-2015-8062 https://access.redhat.com/security/cve/CVE-2015-8063 https://access.redhat.com/security/cve/CVE-2015-8064 https://access.redhat.com/security/cve/CVE-2015-8065 https://access.redhat.com/security/cve/CVE-2015-8066 https://access.redhat.com/security/cve/CVE-2015-8067 https://access.redhat.com/security/cve/CVE-2015-8068 https://access.redhat.com/security/cve/CVE-2015-8069 https://access.redhat.com/security/cve/CVE-2015-8070 https://access.redhat.com/security/cve/CVE-2015-8071 https://access.redhat.com/security/cve/CVE-2015-8401 https://access.redhat.com/security/cve/CVE-2015-8402 https://access.redhat.com/security/cve/CVE-2015-8403 https://access.redhat.com/security/cve/CVE-2015-8404 https://access.redhat.com/security/cve/CVE-2015-8405 https://access.redhat.com/security/cve/CVE-2015-8406 https://access.redhat.com/security/cve/CVE-2015-8407 https://access.redhat.com/security/cve/CVE-2015-8408 https://access.redhat.com/security/cve/CVE-2015-8409 https://access.redhat.com/security/cve/CVE-2015-8410 https://access.redhat.com/security/cve/CVE-2015-8411 https://access.redhat.com/security/cve/CVE-2015-8412 https://access.redhat.com/security/cve/CVE-2015-8413 https://access.redhat.com/security/cve/CVE-2015-8414 https://access.redhat.com/security/cve/CVE-2015-8415 https://access.redhat.com/security/cve/CVE-2015-8416 https://access.redhat.com/security/cve/CVE-2015-8417 https://access.redhat.com/security/cve/CVE-2015-8418 https://access.redhat.com/security/cve/CVE-2015-8419 https://access.redhat.com/security/cve/CVE-2015-8420 https://access.redhat.com/security/cve/CVE-2015-8421 https://access.redhat.com/security/cve/CVE-2015-8422 https://access.redhat.com/security/cve/CVE-2015-8423 https://access.redhat.com/security/cve/CVE-2015-8424 https://access.redhat.com/security/cve/CVE-2015-8425 https://access.redhat.com/security/cve/CVE-2015-8426 https://access.redhat.com/security/cve/CVE-2015-8427 https://access.redhat.com/security/cve/CVE-2015-8428 https://access.redhat.com/security/cve/CVE-2015-8429 https://access.redhat.com/security/cve/CVE-2015-8430 https://access.redhat.com/security/cve/CVE-2015-8431 https://access.redhat.com/security/cve/CVE-2015-8432 https://access.redhat.com/security/cve/CVE-2015-8433 https://access.redhat.com/security/cve/CVE-2015-8434 https://access.redhat.com/security/cve/CVE-2015-8435 https://access.redhat.com/security/cve/CVE-2015-8436 https://access.redhat.com/security/cve/CVE-2015-8437 https://access.redhat.com/security/cve/CVE-2015-8438 https://access.redhat.com/security/cve/CVE-2015-8439 https://access.redhat.com/security/cve/CVE-2015-8440 https://access.redhat.com/security/cve/CVE-2015-8441 https://access.redhat.com/security/cve/CVE-2015-8442 https://access.redhat.com/security/cve/CVE-2015-8443 https://access.redhat.com/security/cve/CVE-2015-8444 https://access.redhat.com/security/cve/CVE-2015-8445 https://access.redhat.com/security/cve/CVE-2015-8446 https://access.redhat.com/security/cve/CVE-2015-8447 https://access.redhat.com/security/cve/CVE-2015-8448 https://access.redhat.com/security/cve/CVE-2015-8449 https://access.redhat.com/security/cve/CVE-2015-8450 https://access.redhat.com/security/cve/CVE-2015-8451 https://access.redhat.com/security/cve/CVE-2015-8452 https://access.redhat.com/security/cve/CVE-2015-8453 https://access.redhat.com/security/cve/CVE-2015-8454 https://access.redhat.com/security/cve/CVE-2015-8455 https://helpx.adobe.com/security/products/flash-player/apsb15-32.html

1 0

[arch-security] [ASA-201512-6] libxml2: multiple issues
by Levente Polyak 09 Dec '15

09 Dec '15

Arch Linux Security Advisory ASA-201512-6 ========================================= Severity: Medium Date : 2015-12-09 CVE-ID : CVE-2015-1819 CVE-2015-5312 CVE-2015-7941 CVE-2015-7942 CVE-2015-7497 CVE-2015-7498 CVE-2015-7499 CVE-2015-7500 CVE-2015-8035 CVE-2015-8242 Package : libxml2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libxml2 before version 2.9.3-1 is vulnerable to multiple issues including but not limited to denial of service, information disclosure or possibly other unspecified impact. Resolution ========== Upgrade to 2.9.3-1. # pacman -Syu "libxml2>=2.9.3-1" The problems have been fixed upstream in version 2.9.3. Workaround ========== None. Description =========== - CVE-2015-1819 (denial of service) A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory. - CVE-2015-5312 (denial of service) A denial of service flaw was found that is leading to CPU exhaustion when processing specially crafted XML input. The issue was within detecting entities expansions in certain situations. - CVE-2015-7941 (denial of service) It has been discovered that libxml2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities. - CVE-2015-7942 (denial of service) The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data. - CVE-2015-7497 (buffer overflow) A heap-based buffer overflow has been discovered in xmlDictComputeFastQKey. It was possible to hit a negative offset in the name indexing used to randomize the dictionary key generation. - CVE-2015-7498 (buffer overflow) A Heap-based buffer overflow was found in xmlParseXmlDecl. When conversion failure happens, parser continues to extract more errors which may lead to unexpected behavior. - CVE-2015-7499 (buffer overflow) A heap-based buffer overflow was found in xmlGROW allowing the attacker to read the memory out of bounds. - CVE-2015-7500 (buffer overflow) A Heap-based buffer overflow has been discovered in xmlParseMisc when not properly handling the case where the parser popped out of the current entity while processing a start tag. - CVE-2015-8035 (denial of service) A denial of service vulnerability has been discovered when parsing specially crafted XML document while XZ support is enabled. The xz_decomp function in xzlib.c did not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data. - CVE-2015-8242 (buffer overflow) A stack buffer overflow has been discovered in push mode in xmlSAX2TextNode. It is possible to have an input cause out of bounds memory to be returned to userspace through the use of libxml2, which could be used to cause denial of service attacks, or gain sensitive information. Impact ====== A remote attacker is able to create specially crafted XML files that, when opened or processed, is leading to denial of service, disclosure of sensitive information or possibly have other unspecified impact. References ========== https://access.redhat.com/security/cve/CVE-2015-1819 https://access.redhat.com/security/cve/CVE-2015-5312 https://access.redhat.com/security/cve/CVE-2015-7941 https://access.redhat.com/security/cve/CVE-2015-7942 https://access.redhat.com/security/cve/CVE-2015-7497 https://access.redhat.com/security/cve/CVE-2015-7498 https://access.redhat.com/security/cve/CVE-2015-7499 https://access.redhat.com/security/cve/CVE-2015-7500 https://access.redhat.com/security/cve/CVE-2015-8035 https://access.redhat.com/security/cve/CVE-2015-8242 https://mail.gnome.org/archives/xml/2015-November/msg00012.html https://bugs.archlinux.org/task/47095

1 0

[arch-security] [ASA-201512-5] chromium: multiple issues
by Levente Polyak 09 Dec '15

09 Dec '15

Arch Linux Security Advisory ASA-201512-5 ========================================= Severity: Critical Date : 2015-12-09 CVE-ID : CVE-2015-6788 CVE-2015-6789 CVE-2015-6790 CVE-2015-6791 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 47.0.2526.80-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, escaping issues and various other unspecified vulnerabilities. Resolution ========== Upgrade to 47.0.2526.80-1. # pacman -Syu "chromium>=47.0.2526.80-1" The problems have been fixed upstream in version 47.0.2526.80. Workaround ========== None. Description =========== - CVE-2015-6788 (arbitrary code execution) A type confusion vulnerability has been discovered in the handling of extensions that could possibly lead to arbitrary code execution. - CVE-2015-6789 (arbitrary code execution) A use-after free vulnerability has been discovered in Blink that could possibly lead to arbitrary code execution. - CVE-2015-6790 (insufficient escaping) An escaping issue has been discovered in saved pages that has unspecified impact. - CVE-2015-6791 (multiple issues) Various unspecified vulnerabilities have been discovered from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker is able to take advantage of multiple vulnerabilities to execute arbitrary code or have other unspecified impact. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6788 https://access.redhat.com/security/cve/CVE-2015-6789 https://access.redhat.com/security/cve/CVE-2015-6790 https://access.redhat.com/security/cve/CVE-2015-6791 http://googlechromereleases.blogspot.fr/2015/12/stable-channel-update_8.html

1 0

[arch-security] [ASA-201512-4] nodejs: multiple issues
by Remi Gacogne 05 Dec '15

05 Dec '15

Arch Linux Security Advisory ASA-201512-4 ========================================= Severity: High Date : 2015-12-05 CVE-ID : CVE-2015-6764 CVE-2015-8027 Package : nodejs Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nodejs before version 5.1.1-1 is vulnerable to multiple issues, including but not limited to denial of service. Resolution ========== Upgrade to 5.1.1-1. # pacman -Syu "nodejs>=5.1.1-1" The problem has been fixed upstream in version 0.12.9, 4.2.3 and 5.1.1. Workaround ========== None. Description =========== - CVE-2015-6764 (V8 out-of-bounds access vulnerability): A bug was discovered in V8's implementation of JSON.stringify() that can result in out-of-bounds reads on arrays. The patch was included in this week's update of Chrome Stable. While this bug is high severity for browsers, it is considered lower risk for Node.js users as it requires the execution of third-party JavaScript within an application in order to be exploitable. Node.js users who expose services that process untrusted user-supplied JavaScript are at obvious risk. However, we recommend that all users of impacted versions of Node.js upgrade to the appropriate patched version in order to protect against malicious third-party JavaScript that may be executed within a Node.js process by other means. - CVE-2015-8027 (denial of service): This critical denial of service (DoS) vulnerability impacts all versions of v0.12.x through to v5.x, inclusive. The vulnerability was discovered by Node.js core team member Fedor Indutny and relates to HTTP pipelining. Under certain conditions an HTTP socket may no longer have a parser associated with it but a pipelined request can trigger a pause or resume on the non-existent parser thereby causing an uncaughtException to be thrown. As these conditions can be created by an external attacker and cause a Node.js service to be shut down we consider this a critical vulnerability. It is recommended that users of impacted versions of Node.js exposing HTTP services upgrade to the appropriate patched versions as soon as practical. Impact ====== A remote attacker can shutdown a vulnerable Node.js service, or have unspecified impact via out-of-bounds reads on array. References ========== https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/ https://access.redhat.com/security/cve/CVE-2015-6764 https://access.redhat.com/security/cve/CVE-2015-8027

1 0

[arch-security] strange netstat connections after having opened Firefox
by Elmar Stellnberger 05 Dec '15

05 Dec '15

The following number of connections was returned by netstat -atupn while Firefox was already closed and killall-ed to show that it really had sucessfully closed itself before (It was open only for short mainly in order to reboot my router.): Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 192.168.100.101:50056 5.196.185.225:80 TIME_WAIT - tcp 0 0 192.168.100.101:35860 92.92.207.51:80 TIME_WAIT - tcp 0 0 192.168.100.101:40912 195.154.59.140:80 TIME_WAIT - tcp 0 0 192.168.100.101:58746 178.63.62.19:80 TIME_WAIT - tcp 0 0 192.168.100.101:40482 52.32.86.111:443 TIME_WAIT - tcp 0 0 192.168.100.101:43256 46.4.37.89:80 TIME_WAIT - udp 0 0 192.168.100.101:59824 193.170.62.252:123 ESTABLISHED 328/ntpd: ntp engin udp 0 0 192.168.100.101:40120 80.64.132.152:123 ESTABLISHED 328/ntpd: ntp engin udp 0 0 0.0.0.0:68 0.0.0.0:* 304/dhcpcd There should not be any unnamed daemon opening up such connections under Arch Linux when netstat -atupn is run as root, right? (At least I have installed none; I already know from previous netstats that Arch is very strict with its default configuration in this regard.) What has made me look was a 100% CPU load indicated by my CPU fan but actually not by the KDE GUI (sorry, forgot to run top and do similar things). The 100% 'fan' load remained after unplugging the cable; as well as the connections shown by netstat. I would believe that it is not an attack by an US-service because usually with similar incidents no such connection list is returned by netstat. Perhaps anyone can be helpful with that? Elmar

9 16

[arch-security] [ASA-201512-3] python-django, python2-django: information leakage
by Remi Gacogne 05 Dec '15

05 Dec '15

Arch Linux Security Advisory ASA-201512-3 ========================================= Severity: Medium Date : 2015-12-05 CVE-ID : CVE-2015-8213 Package : python-django, python2-django Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages python-django and python2-django before version 1.8.7-1 are vulnerable to information leakage. Resolution ========== Upgrade to 1.8.7-1. # pacman -Syu "python-django>=1.8.7-1" # pacman -Syu "python2-django>=1.8.7-1" The problem has been fixed upstream in version 1.8.7 and 1.7.11. Workaround ========== None. Description =========== If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y". To remedy this, the underlying function used by the date template filter, django.utils.formats.get_format(), now only allows accessing the date/time formatting settings. Impact ====== A remote attacker might be able to access sensitive information from a vulnerable application. References ========== https://access.redhat.com/security/cve/CVE-2015-8213 https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/

1 0