October 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201610-9] gdk-pixbuf2: arbitrary code execution
by Levente Polyak 13 Oct '16

13 Oct '16

Arch Linux Security Advisory ASA-201610-9 ========================================= Severity: Critical Date : 2016-10-13 CVE-ID : CVE-2016-6352 Package : gdk-pixbuf2 Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gdk-pixbuf2 before version 2.36.0+2+ga7c869a-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.36.0+2+ga7c869a-1. # pacman -Syu "gdk-pixbuf2>=2.36.0+2+ga7c869a-1" The problem has been fixed upstream in version 2.35.3. Workaround ========== None. Description =========== An out-of-bounds write has been discovered in the OneLine32() function while parsing an ico file. A maliciously crafted file can cause the application to crash or possibly execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted ico file that, when loaded, is leading to arbitrary code execution. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=769170 https://bugzilla.redhat.com/show_bug.cgi?id=1349751 https://git.gnome.org/browse/gdk-pixbuf/commit/?id=88af50a864195da1a4f7bda5… https://access.redhat.com/security/cve/CVE-2016-6352

1 0

[arch-security] [ASA-201610-8] crypto++: information disclosure
by Santiago Torres-Arias 12 Oct '16

12 Oct '16

Arch Linux Security Advisory ASA-201610-8 ========================================= Severity: Medium Date : 2016-10-12 CVE-ID : CVE-2016-7420 Package : crypto++ Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package crypto++ before version 5.6.5-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 5.6.5-1. # pacman -Syu "crypto++>=5.6.5-1" The problem has been fixed upstream in version 5.6.5. Workaround ========== None. Description =========== Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintended in production use, which might allow context- dependent attackers to obtain sensitive information by leveraging access to process memory after an assertion failure, as demonstrated by reading a core dump. Impact ====== An attacker can provide input to programs using crypto++ that may cause a crash and lead to the disclosure of sensitive information in a core dump. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7420 https://bugs.archlinux.org/task/51331 https://github.com/weidai11/cryptopp/issues/277 http://www.openwall.com/lists/oss-security/2016/09/15/12

1 0

[arch-security] [ASA-201610-7] wpa_supplicant: multiple issues
by Christian Rebischke 08 Oct '16

08 Oct '16

Arch Linux Security Advisory ASA-201610-7 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : wpa_supplicant Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wpa_supplicant before version 1:2.6-1 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 1:2.6-1. # pacman -Syu "wpa_supplicant>=1:2.6-1" The problems have been fixed upstream in version 2.6. Workaround ========== None. Description =========== - CVE-2016-4476 (denial of service) A vulnerability was found in how hostapd and wpa_supplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters either through a WPS operation or through local configuration change over the wpa_supplicant control interface, the resulting configuration file may prevent the hostapd and wpa_supplicant from starting when the updated file is used. - CVE-2016-4477 (privilege escalation) The local configuration update through the control interface SET_NETWORK command could allow privilege escalation for the local user to run code from a locally stored library file under the same privileges as the wpa_supplicant process has. The assumption here is that a not fully trusted user/application might have access through a connection manager to set network profile parameters like psk, but would not have access to set other configuration file parameters. If the connection manager in such a case does not filter out control characters from the psk value, it could have been possible to practically update the global parameters by embedding a newline character within the psk value. In addition, the untrusted user/application would need to be able to install a library file somewhere on the device from where the wpa_supplicant process has privileges to load the library. Impact ====== A remote attacker is able to perform a denial of service attack that prevents hostapd from starting. Furthermore a local attacker is able to elevate privileges by a local configuration update under certain circumstances. References ========== http://www.openwall.com/lists/oss-security/2016/05/03/2 https://access.redhat.com/security/cve/CVE-2016-4476 https://access.redhat.com/security/cve/CVE-2016-4477

1 0

[arch-security] [ASA-201610-6] imagemagick: multiple issues
by Christian Rebischke 08 Oct '16

08 Oct '16

Arch Linux Security Advisory ASA-201610-6 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-7799 CVE-2016-7906 Package : imagemagick Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.6.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 6.9.6.0-1. # pacman -Syu "imagemagick>=6.9.6.0-1" The problems have been fixed upstream in version 6.9.6.0. Workaround ========== None. Description =========== - CVE-2016-7799 (denial of service) A buffer over-read vulnerability was found in ImageMagick. A malicious file could cause the application to crash. - CVE-2016-7906 (arbitrary code execution) An attacker is able to trigger a use-after-free when providing a crafted image to ImageMagick's mogrify function. Impact ====== A remote attacker is able to craft a malicious image to execute arbitrary code or crash the application. References ========== https://github.com/ImageMagick/ImageMagick/commit/a7bb158b7bedd1449a34432fe… http://www.openwall.com/lists/oss-security/2016/10/01/6 https://github.com/ImageMagick/ImageMagick/issues/280 https://github.com/ImageMagick/ImageMagick/issues/281 http://www.openwall.com/lists/oss-security/2016/10/02/3 https://github.com/ImageMagick/ImageMagick/commit/d63a3c5729df59f183e9e110d… https://access.redhat.com/security/cve/CVE-2016-7799 https://access.redhat.com/security/cve/CVE-2016-7906

1 0

[arch-security] [ASA-201610-5] messagelib: multiple issues
by Christian Rebischke 07 Oct '16

07 Oct '16

Arch Linux Security Advisory ASA-201610-5 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7967 CVE-2016-7968 Package : messagelib Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package messagelib before version 16.08.1-2 is vulnerable to multiple issues including cross-site scripting and insufficient validation. Resolution ========== Upgrade to 16.08.1-2. # pacman -Syu "messagelib>=16.08.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2016-7967 (cross-site scripting) KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled. - CVE-2016-7968 (insufficient validation) KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed. Impact ====== An attacker is able to access local or remote urls via injected javascript. References ========== https://www.kde.org/info/security/advisory-20161006-1.txt https://www.kde.org/info/security/advisory-20161006-3.txt http://seclists.org/oss-sec/2016/q4/23 https://www.kde.org/info/security/advisory-20161006-2.txt http://seclists.org/oss-sec/2016/q4/21 https://access.redhat.com/security/cve/CVE-2016-7967 https://access.redhat.com/security/cve/CVE-2016-7968s

1 0

[arch-security] [ASA-201610-4] kcoreaddons: insufficient validation
by Christian Rebischke 07 Oct '16

07 Oct '16

Arch Linux Security Advisory ASA-201610-4 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7966 Package : kcoreaddons Type : insufficient validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package kcoreaddons before version 5.26.0-2 is vulnerable to insufficient validation. Resolution ========== Upgrade to 5.26.0-2. # pacman -Syu "kcoreaddons>=5.26.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plain text viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content. Impact ====== A remote attacker is able to inject HTML code in KMail's plain text viewer. References ========== https://www.kde.org/info/security/advisory-20161006-1.txt http://seclists.org/oss-sec/2016/q4/23 https://access.redhat.com/security/cve/CVE-2016-7966

1 0

[arch-security] [ASA-201610-3] hostapd: multiple issues
by Levente Polyak 04 Oct '16

04 Oct '16

Arch Linux Security Advisory ASA-201610-3 ========================================= Severity: High Date : 2016-10-04 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : hostapd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package hostapd before version 2.6-1 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 2.6-1. # pacman -Syu "hostapd>=2.6-1" The problems have been fixed upstream in version 2.6. Workaround ========== None. Description =========== - CVE-2016-4476 (denial of service) A vulnerability was found in how hostapd and wpa_supplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters either through a WPS operation or through local configuration change over the wpa_supplicant control interface, the resulting configuration file may prevent the hostapd and wpa_supplicant from starting when the updated file is used. - CVE-2016-4477 (privilege escalation) The local configuration update through the control interface SET_NETWORK command could allow privilege escalation for the local user to run code from a locally stored library file under the same privileges as the wpa_supplicant process has. The assumption here is that a not fully trusted user/application might have access through a connection manager to set network profile parameters like psk, but would not have access to set other configuration file parameters. If the connection manager in such a case does not filter out control characters from the psk value, it could have been possible to practically update the global parameters by embedding a newline character within the psk value. In addition, the untrusted user/application would need to be able to install a library file somewhere on the device from where the wpa_supplicant process has privileges to load the library. Impact ====== A remote attacker is able to perform a denial of service attack that prevents hostapd from starting. Furthermore a local attacker is able to elevate privileges by a local configuration update under certain circumstances. References ========== http://www.openwall.com/lists/oss-security/2016/05/03/2 https://w1.fi/security/2016-1/psk-parameter-config-update.txt https://access.redhat.com/security/cve/CVE-2016-4476 https://access.redhat.com/security/cve/CVE-2016-4477

1 0

[arch-security] [ASA-201610-2] systemd: denial of service
by Levente Polyak 04 Oct '16

04 Oct '16

Arch Linux Security Advisory ASA-201610-2 ========================================= Severity: High Date : 2016-10-04 CVE-ID : CVE-2016-7795 Package : systemd Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package systemd before version 231-2 is vulnerable to denial of service. Resolution ========== Upgrade to 231-2. # pacman -Syu "systemd>=231-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== systemd fails an assertion in manager_invoke_notify_message when a zero-length message is received over its notification socket. After failing the assertion, PID 1 hangs in the pause system call. It is no longer possible to start and stop daemons or cleanly reboot the system. Inetd-style services managed by systemd no longer accept connections. Since the notification socket, /run/systemd/notify, is world-writable, this allows a local user to perform a denial-of-service attack against systemd. Proof-of-concept: NOTIFY_SOCKET=/run/systemd/notify systemd-notify "" Impact ====== A local attacker is able to perform a denial of service attack by obstructing start/stop of any daemons and clean reboot of the system. References ========== https://github.com/systemd/systemd/issues/4234 http://www.openwall.com/lists/oss-security/2016/09/28/9 https://access.redhat.com/security/cve/CVE-2016-7795

1 0

[arch-security] [ASA-201610-1] chromium: arbitrary code execution
by Christian Rebischke 03 Oct '16

03 Oct '16

rch Linux Security Advisory ASA-201610-1 ========================================= Severity: Critical Date : 2016-10-03 CVE-ID : CVE-2016-5177 CVE-2016-5178 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 53.0.2785.143-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 53.0.2785.143-1. # pacman -Syu "chromium>=53.0.2785.143-1" The problems have been fixed upstream in version 53.0.2785.143. Workaround ========== None. Description =========== - CVE-2016-5177 (arbitrary code execution) Use after free in V8. - CVE-2016-5178 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker could be able to execute arbitrary code. References ========== https://googlechromereleases.blogspot.fr/2016/09/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5177 https://access.redhat.com/security/cve/CVE-2016-5178

1 0