May 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201505-20] curl: information leakage
by Remi Gacogne 28 May '15

28 May '15

Arch Linux Security Advisory ASA-201505-20 ========================================== Severity: Low Date : 2015-05-28 CVE-ID : CVE-2015-3153 Package : curl Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.42.1-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.42.1-1. # pacman -Syu "curl>=7.42.1-1" The problem has been fixed upstream in version 7.42.1. Workaround ========== This issue can be mitigated when using curl >= 7.37.0: - in libcurl, by setting CURLOPT_HEADEROPT to CURLHEADER_SEPARATE ; - in command-line, by using --proxy-header. Description =========== libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPT_HTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option. When the connection passes through an HTTP proxy the same set of headers is sent to the proxy as well by default. While this is by design, it has not necessarily been clear nor understood by application programmers. Such tunneling over a proxy is done for example when using the HTTPS protocol - or when explicitly asked for. In this case, the initial connection to the proxy is made in clear including any custom headers using the HTTP CONNECT method. While libcurl provides the CURLOPT_HEADEROPT option to allow applications to tell libcurl if the headers should be sent to host and the proxy or use separate lists to the different destinations, it has still defaulted to sending the same headers to both parties for the sake of compatibility. If the application sets a custom HTTP header with sensitive content (e.g., authentication cookies) without changing the default, the proxy, and anyone who listens to the traffic between the application and the proxy, might get access to those values. Note: this problem doesn't exist when using the CURLOPT_COOKIE option (or the '--cookie' option) or the HTTP auth options, which are always sent only to the destination server. Impact ====== An adversary controlling the HTTP proxy used by client using curl (or libcurl), or listening to the traffic between the application and the proxy, can access to potentially sensitive information contained in HTTP headers. References ========== http://curl.haxx.se/docs/adv_20150429.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3153

1 0

[arch-security] [ASA-201505-19] webkitgtk2: man-in-the-middle
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-19 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-2330 Package : webkitgtk2 Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package webkitgtk2 before version 2.4.9-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "webkitgtk2>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== It was found that WebKitGTK+ version performed TLS certificate verification too late, after sending an HTTP request rather than before. This issue allows a man-in-the-middle attack to possibly gain sensitive information. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via a crafted TLS certificate to obtain sensitive information. References ========== http://www.openwall.com/lists/oss-security/2015/03/18/4 https://access.redhat.com/security/cve/CVE-2015-2330 https://bugs.archlinux.org/task/44237

1 0

[arch-security] [ASA-201505-18] webkitgtk: man-in-the-middle
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-18 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-2330 Package : webkitgtk Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package webkitgtk before version 2.4.9-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "webkitgtk>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== It was found that WebKitGTK+ version performed TLS certificate verification too late, after sending an HTTP request rather than before. This issue allows a man-in-the-middle attack to possibly gain sensitive information. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via a crafted TLS certificate to obtain sensitive information. References ========== http://www.openwall.com/lists/oss-security/2015/03/18/4 https://access.redhat.com/security/cve/CVE-2015-2330 https://bugs.archlinux.org/task/44237

1 0

[arch-security] [ASA-201505-17] postgresql: multiple issues
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-17 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-3165 CVE-2015-3166 CVE-2015-3167 Package : postgresql Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package postgresql before version 9.4.2-1 is vulnerable to denial of service, information disclosure and possibly key exposure via a side-channel attack. Resolution ========== Upgrade to 9.4.2-1. # pacman -Syu "postgresql>=9.4.2-1" The problems have been fixed upstream in version 9.4.2. Workaround ========== None. Description =========== - CVE-2015-3165 (denial of service) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash via a double-free issue leading to denial of service. - CVE-2015-3166 (information disclosure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information disclosure. - CVE-2015-3167 (side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message. Impact ====== A remote attacker is able to perform denial of service, disclose sensitive information or possibly expose a cryptographic key via a side-channel attack. References ========== http://www.postgresql.org/about/news/1587/ https://access.redhat.com/security/cve/CVE-2015-3165 https://access.redhat.com/security/cve/CVE-2015-3166 https://access.redhat.com/security/cve/CVE-2015-3167

1 0

[arch-security] [ASA-201505-16] pgbouncer: denial of service
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-16 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-4054 Package : pgbouncer Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pgbouncer before version 1.5.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.5-1. # pacman -Syu "pgbouncer>=1.5.5-1" The problem has been fixed upstream in version 1.5.5. Workaround ========== None. Description =========== A remote denial of service vulnerability in check_client_passwd() has been discovered. The issue is triggered if a password packet appears before the startup packet. In such case a null pointer is dereferenced that is leading to application crash. Impact ====== A remote attacker is able to send specially crafted packets that is leading to application crash resulting in denial of service. References ========== http://www.openwall.com/lists/oss-security/2015/05/21/2 https://access.redhat.com/security/cve/CVE-2015-4054 https://github.com/pgbouncer/pgbouncer/issues/42

1 0

[arch-security] [ASA-201505-15] nbd: denial of service
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-15 ========================================== Severity: Low Date : 2015-05-26 CVE-ID : CVE-2015-0847 Package : nbd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nbd before version 3.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.11-1. # pacman -Syu "nbd>=3.11-1" The problem has been fixed upstream in version 3.11. Workaround ========== None. Description =========== Signal handlers themselves were entered only once, but they called posixly unsafe, non-reentrant functions, such as syslog(). If a signal was caught in the middle of the execution of such function, consequences were undefined. In practice, nbd-server was observed to deadlock during the execution of sigchld_handler(). Impact ====== A remote attacker is able to send requests to the nbd server that may lead to a deadlock resulting in denial of service. References ========== http://sourceforge.net/p/nbd/mailman/message/34091218/ https://access.redhat.com/security/cve/CVE-2015-0847 https://github.com/yoe/nbd/commit/412def

1 0

[arch-security] [ASA-201505-14] chromium: multiple issues
by Levente Polyak 21 May '15

21 May '15

Arch Linux Security Advisory ASA-201505-14 ========================================== Severity: Critical Date : 2015-05-21 CVE-ID : CVE-2015-1251 CVE-2015-1252 CVE-2015-1253 CVE-2015-1254 CVE-2015-1255 CVE-2015-1256 CVE-2015-1257 CVE-2015-1258 CVE-2015-1259 CVE-2015-1260 CVE-2015-1263 CVE-2015-1264 CVE-2015-1265 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 43.0.2357.65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox protection bypass, same origin policy bypass, denial of service, cross side scripting and man-in-the-middle. Resolution ========== Upgrade to 43.0.2357.65-1. # pacman -Syu "chromium>=43.0.2357.65-1" The problems have been fixed upstream in version 43.0.2357.65. Workaround ========== None. Description =========== - CVE-2015-1251 (arbitrary code execution) Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem allows remote attackers to execute arbitrary code via a crafted document. - CVE-2015-1252 (sandbox protection bypass) It has been discovered that common/partial_circular_buffer.cc does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. - CVE-2015-1253 (same origin policy bypass) It has been discovered that core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. - CVE-2015-1254 (same origin policy bypass) It has been discovered that core/dom/Document.cpp in Blink enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. - CVE-2015-1255 (denial of service) Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track. - CVE-2015-1256 (denial of service) Use-after-free vulnerability in the SVG implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element. - CVE-2015-1257 (denial of service) It has been discovered that platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document. - CVE-2015-1258 (denial of service) Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data. - CVE-2015-1259 (denial of service) PDFium does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2015-1260 (denial of service) Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request. - CVE-2015-1263 (man-in-the-middle) The Spellcheck API implementation does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file. - CVE-2015-1264 (cross side scripting) Cross-site scripting (XSS) vulnerability allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. - CVE-2015-1265 (denial of service) Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, bypass the sandbox protection mechanism, bypass the same origin policy, perform cross side scripting, perform a denial of service attack or possibly have unspecified other impact via various vectors. References ========== http://googlechromereleases.blogspot.fr/2015/05/stable-channel-update_19.ht… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1251 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1252 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1253 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1254 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1255 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1256 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1257 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1258 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1259 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1260 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1263 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1264 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1265

1 0

[arch-security] Fw: Django security release issued (1.8.2)
by Markus Holtermann 21 May '15

21 May '15

Today the Django team issued Django 1.8.2 as part of our security process. This releases address a security issue, and we encourage all users to upgrade as soon as possible. More details can be found on our blog: https://www.djangoproject.com/weblog/2015/may/20/security-release/ As a reminder, we ask that potential security issues be reported via private email to security(a)djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see https://www.djangoproject.com/security for further information. --

2 1

[arch-security] [ASA-201505-13] thunderbird: multiple issues
by Remi Gacogne 18 May '15

18 May '15

Arch Linux Security Advisory ASA-201505-13 ========================================== Severity: Critical Date : 2015-05-18 CVE-ID : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 31.7.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 31.7.0-1. # pacman -Syu "thunderbird>=31.7.0-1" The problem has been fixed upstream in version 31.7.0. Workaround ========== CVE-2015-2708, CVE-2015-2709, CVE-2015-2710 and CVE-2015-2716 cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts. There is no workaround for CVE-2015-2713. Description =========== - CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and Firefox 38): Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported memory safety problems and crashes that affect Firefox ESR 31.6 and Firefox 37. - CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2710 (Buffer overflow with SVG content and CSS): Using the Address Sanitizer tool, security researcher Atte Kettunen found a buffer overflow during the rendering of SVG format graphics when combined with specific CSS properties on a page. This results in a potentially exploitable crash. - CVE-2015-2713 (Use-after-free during text processing with vertical text enabled): Security researcher Scott Bell used the Address Sanitizer tool to discover a use-after-free error during the processing of text when vertical text is enabled. This leads to a potentially exploitable crash. - CVE-2015-2716 (Buffer overflow when parsing compressed XML): Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash. Impact ====== A remote attacker can execute arbitrary code with the privileges of the current user. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716

1 0

[arch-security] [ASA-201505-12] wireshark-gtk: denial of service
by Levente Polyak 15 May '15

15 May '15

Arch Linux Security Advisory ASA-201505-12 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-gtk before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-gtk>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

1 0