February 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201502-5] chromium: multiple issues
by Remi Gacogne 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-5 ========================================= Severity: High Date : 2015-02-06 CVE-ID : CVE-2015-1209 CVE-2015-1210 CVE-2015-1211 CVE-2015-1212 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 40.0.2214.111-1 is vulnerable to multiple issues, including but not limited to privilege escalation, cross-origin bypass and arbitrary code execution. Resolution ========== Upgrade to 40.0.2214.111-1. # pacman -Syu "chromium>=40.0.2214.111-1" The problem has been fixed upstream in version 40.0.2214.111. Workaround ========== None. Description =========== - CVE-2015-1209 (use-after-free) Use-after-free in DOM, possibly leading to arbitrary code execution. Credit to Maksymillian Motyl. - CVE-2015-1210 (cross-origin bypass) Cross-origin-bypass in V8 bindings allows an attacker to bypass the same-origin policy. - CVE-2015-1211 (privilege escalation) Privilege escalation using service workers. - CVE-2015-1212 Various fixes from internal audits, fuzzing and other initiatives, fixing unspecified vulnerabilities not disclosed by upstream. Impact ====== A remote attacker is able to bypass the same-origin policy, escalate privileges or execute arbitrary code. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1209 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1210 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1211 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1212 http://googlechromereleases.blogspot.fr/2015/02/stable-channel-update.html

1 0

[arch-security] [ASA-201502-4] postgresql: multiple issues
by Remi Gacogne 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-4 ========================================= Severity: High Date : 2015-02-06 CVE-ID : CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 Package : postgresql Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package postgresql before version 9.4.1-1 is vulnerable to multiple issues, including information leak, denial of service, privilege escalation and command injection. Resolution ========== Upgrade to 9.4.1-1. # pacman -Syu "postgresql>=9.4.1-1" The problem has been fixed upstream in version 9.4.1. Workaround ========== None. Description =========== - CVE-2014-8161 (information leak) Some server error messages show the values of columns that violate a constraint, such as a unique constraint. If the user does not have SELECT privilege on all columns of the table, this could mean exposing values that the user should not be able to see. Adjust the code so that values are displayed only when they came from the SQL command or could be selected by the user. - CVE-2015-0241 (denial of service, privilege escalation) When to_char() processes a numeric formatting template calling for a large number of digits, PostgreSQL would read past the end of a buffer. When processing a crafted timestamp formatting template, PostgreSQL would write past the end of a buffer. Either case could crash the server. We have not ruled out the possibility of attacks that lead to privilege escalation, though they seem unlikely. - CVE-2015-0243 (denial of service, privilege escalation) Errors in memory size tracking within the pgcrypto module permitted stack buffer overruns and improper dependence on the contents of uninitialized memory. The buffer overrun cases can crash the server, and we have not ruled out the possibility of attacks that lead to privilege escalation. - CVE-2015-0244 (command injection) If any error occurred while the server was in the middle of reading a protocol message from the client, it could lose synchronization and incorrectly try to interpret part of the message's data as a new protocol message. An attacker able to submit crafted binary data within a command parameter might succeed in injecting his own SQL commands this way. Statement timeout and query cancellation are the most likely sources of errors triggering this scenario. Particularly vulnerable are applications that use a timeout and also submit arbitrary user-crafted data as binary query parameters. Disabling statement timeout will reduce, but not eliminate, the risk of exploit. Our thanks to Emil Lenngren for reporting this issue. Impact ====== A remote, authenticated attacker might be able to get access to sensitive information, escalate privileges or cause a denial of service by crashing the server. A remote attacker could inject arbitrary SQL command by submitting crafted binary data within a command parameter. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8161 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0241 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0243 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0244 http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

1 0

[arch-security] [ASA-201502-3] mantisbt: multiple issues
by Levente Polyak 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-3 ========================================= Severity: High Date : 2015-02-06 CVE-ID : CVE-2014-9571 CVE-2014-9572 CVE-2014-9573 CVE-2014-9624 CVE-2015-1042 Package : mantisbt Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mantisbt before version 1.2.19-1 is vulnerable to multiple issues including cross-side scripting, database credential disclosure, sql injection, captcha bypass and url redirection. Resolution ========== Upgrade to 1.2.19-1. # pacman -Syu "mantisbt>=1.2.19-1" The problems have been fixed upstream in version 1.2.19. Workaround ========== None. Description =========== - CVE-2014-9571 (cross-side scripting) Cross-site scripting (XSS) vulnerability in admin/install.php allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter. - CVE-2014-9572 (information disclosure) It was discovered that mantisbt does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4. - CVE-2014-9573 (sql injection) SQL injection vulnerability in manage_user_page.php allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie. - CVE-2014-9624 (captcha bypass) An attacker can get an unlimited amount of CAPTCHA "samples" with different perturbations for the same challenge, which makes the whole captcha utterly useless and very easy to bypass. - CVE-2015-1042 (url redirection) A bug in the URL sanitization routine allows an attacker to craft an URL that can redirect outside of the MantisBT instance's domain. This is related to CVE-2014-6316 [1], and the same API function is affected by the same vulnerability, but the root cause is different. Impact ====== A remote attacker is able to perform cross-side scripting, obtain database credentials, execute arbitrary SQL commands when having administrator privileges, bypass captchas or craft an URL that redirects to any domain. References ========== https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=1… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9571 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9572 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9573 https://access.redhat.com/security/cve/CVE-2014-9624 https://access.redhat.com/security/cve/CVE-2015-1042

1 0

[arch-security] [ASA-201502-2] flashplugin: remote code execution
by Remi Gacogne 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-2 ========================================= Severity: Critical Date : 2015-02-06 CVE-ID : CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.442-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 11.2.202.442-1. # pacman -Syu "flashplugin>=11.2.202.442-1" The problem has been fixed upstream in version 11.2.202.442. Workaround ========== None. Description =========== - CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322 Use-after-free vulnerabilities leading to arbitrary code execution. - (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330 Memory corruption vulnerabilities leading to arbitrary code execution. - CVE-2015-0317, CVE-2015-0319 Type confusion vulnerabilities leading to arbitrary code execution. - CVE-2015-0323, CVE-2015-0327 Heap overflow vulnerabilities leading to arbitrary code execution. - CVE-2015-0324 Buffer overflow vulnerability leading to arbitrary code execution. - CVE-2015-0325, CVE-2015-0326, CVE-2015-0328 Null-pointer dereference issues, possibly leading to denial of service or other unspecified impact. Impact ====== A remote attacker can execute arbitrary code. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0313 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0314 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0315 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0316 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0317 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0318 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0319 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0320 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0321 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0322 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0323 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0324 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0325 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0326 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0327 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0328 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0329 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0330 https://helpx.adobe.com/security/products/flash-player/apsb15-04.html

1 0

[arch-security] [ASA-201502-1] privoxy: denial of service
by Levente Polyak 03 Feb '15

03 Feb '15

Arch Linux Security Advisory ASA-201502-1 ========================================= Severity: Medium Date : 2015-02-03 CVE-ID : CVE-2015-1380 CVE-2015-1381 CVE-2015-1382 Package : privoxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package privoxy before version 3.0.23-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.0.23-1. # pacman -Syu "privoxy>=3.0.23-1" The problems have been fixed upstream in version 3.0.23. Workaround ========== None. Description =========== - CVE-2015-1380 (denial of service) Denial of service issue was found in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort(). - CVE-2015-1381 (segmentation fault) Multiple segmentation faults and memory leaks were found in the pcrs code. This fix also increases the chances that an invalid pcrs command is rejected as such. Previously some invalid commands would be loaded without error. Note that privoxy's pcrs sources (action and filter files) are considered trustworthy input and should not be writable by untrusted third-parties. - CVE-2015-1382 (denial of service) A 'invalid read' bug was found which could at least theoretically cause privoxy to crash. Impact ====== A remote attacker is able to perform a denial of service attack via crafted requests or a segmentation fault via invalid pcrs commands. References ========== http://seclists.org/oss-sec/2015/q1/285 https://access.redhat.com/security/cve/CVE-2015-1380 https://access.redhat.com/security/cve/CVE-2015-1381 https://access.redhat.com/security/cve/CVE-2015-1382

1 0