December 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201612-21] openfire: multiple issues
by Santiago Torres-Arias 27 Dec '16

27 Dec '16

Arch Linux Security Advisory ASA-201612-21 ========================================== Severity: High Date : 2016-12-23 CVE-ID : CVE-2015-6972 CVE-2015-6973 CVE-2015-7707 Package : openfire Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-15 Summary ======= The package openfire before version 4.1.0-1 is vulnerable to multiple issues including privilege escalation, cross-site request forgery and cross-site scripting. Resolution ========== Upgrade to 4.1.0-1. # pacman -Syu "openfire>=4.1.0-1" The problems have been fixed upstream in version 4.1.0. Workaround ========== None. Description =========== - CVE-2015-6972 (cross-site scripting) Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group- summary.jsp. - CVE-2015-6973 (cross-site request forgery) Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp. - CVE-2015-7707 (privilege escalation) Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit- form.jsp. Impact ====== A remote attacker is able to escalate privileges, perform cross-site request forgery and cross-site scripting. References ========== http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt https://igniterealtime.org/issues/browse/OF-942 http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt https://issues.igniterealtime.org/browse/OF-941 https://security.archlinux.org/CVE-2015-6972 https://security.archlinux.org/CVE-2015-6973 https://security.archlinux.org/CVE-2015-7707

1 0

[arch-security] [ASA-201612-20] openssh: multiple issues
by Levente Polyak 23 Dec '16

23 Dec '16

Arch Linux Security Advisory ASA-201612-20 ========================================== Severity: Medium Date : 2016-12-22 CVE-ID : CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 Package : openssh Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-110 Summary ======= The package openssh before version 7.4p1-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation, information disclosure and insufficient validation. Resolution ========== Upgrade to 7.4p1-1. # pacman -Syu "openssh>=7.4p1-1" The problems have been fixed upstream in version 7.4p1. Workaround ========== None. Description =========== - CVE-2016-10009 (arbitrary code execution) It was found that ssh-agent could load PKCS#11 modules from paths outside of a trusted whitelist. An attacker able to load a crafted PKCS#11 module across a forwarded agent channel could potentially use this flaw to execute arbitrary code on the system running the ssh- agent. Note that the attacker must have control of the forwarded agent- socket and the ability to write to the filesystem of the host running ssh-agent. - CVE-2016-10010 (privilege escalation) It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system. Privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in /etc/ssh/sshd_config. - CVE-2016-10011 (information disclosure) It was found that there is a theoretical leak of host private key material to privilege-separated child processes via realloc() when reading keys. No such leak was observed in practice for normal-sized keys, nor does a leak to the child processes directly expose key material to unprivileged users. - CVE-2016-10012 (insufficient validation) It was found that the shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimizing compilers. Additionally, this memory manager was incorrectly accessible when pre-authentication compression was disabled. This could potentially allow attacks against the privileged monitor process from the sandboxed privilege-separation process (a compromise of the latter would be required first). Impact ====== A remote attacker may be able to perform attacks against the shared memory manager used by pre-authentication compression support. Furthermore a local attacker may be able to execute arbitrary code and disclose sensitive information under certain circumstances or possibly escalate privileges when having privilege separation explicitly disabled. References ========== https://www.openssh.com/txt/release-7.4 http://seclists.org/oss-sec/2016/q4/708 http://seclists.org/oss-sec/2016/q4/705 https://access.redhat.com/security/cve/CVE-2016-10009 https://access.redhat.com/security/cve/CVE-2016-10010 https://access.redhat.com/security/cve/CVE-2016-10011 https://access.redhat.com/security/cve/CVE-2016-10012

1 0

[arch-security] [ASA-201612-19] samba: multiple issues
by Levente Polyak 22 Dec '16

22 Dec '16

Arch Linux Security Advisory ASA-201612-19 ========================================== Severity: Critical Date : 2016-12-22 CVE-ID : CVE-2016-2123 CVE-2016-2125 CVE-2016-2126 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-111 Summary ======= The package samba before version 4.5.3-1 is vulnerable to multiple issues including arbitrary code execution, authentication bypass and privilege escalation. Resolution ========== Upgrade to 4.5.3-1. # pacman -Syu "samba>=4.5.3-1" The problems have been fixed upstream in version 4.5.3. Workaround ========== None. Description =========== - CVE-2016-2123 (arbitrary code execution) The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects, this makes the defect additionally a remote privilege escalation. - CVE-2016-2125 (authentication bypass) Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service. The risks of impersonation of the client are similar to the well known risks from forwarding of NTLM credentials, with two important differences: - NTLM forwarding can and should be mitigated with packet signing - Kerberos forwarding can only be attempted after the trusted destination server decrypts the ticket. - CVE-2016-2126 (privilege escalation) A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. For the remote attack, the memory overwrite kills the main winbindd process and an authenticated attacker can construct this situation by watching for password changes in Samba. One specific trigger occurs when winbindd changes its machine account password and the client has still a valid Kerberos ticket (that was encrypted with the old password). Impact ====== A remote authenticated attacker is able to execute arbitrary code, bypass authentication via unconditional privilege delegation and escalate privileges via various vectors. References ========== https://bugs.archlinux.org/task/52219 https://www.samba.org/samba/security/CVE-2016-2123.html https://www.samba.org/samba/security/CVE-2016-2125.html https://www.samba.org/samba/security/CVE-2016-2126.html https://access.redhat.com/security/cve/CVE-2016-2123 https://access.redhat.com/security/cve/CVE-2016-2125 https://access.redhat.com/security/cve/CVE-2016-2126

1 0

[arch-security] [ASA-201612-18] qt5-webengine: multiple issues
by Remi Gacogne 17 Dec '16

17 Dec '16

Arch Linux Security Advisory ASA-201612-18 ========================================== Severity: Critical Date : 2016-12-17 CVE-ID : CVE-2016-5133 CVE-2016-5147 CVE-2016-5153 CVE-2016-5155 CVE-2016-5161 CVE-2016-5166 CVE-2016-5170 CVE-2016-5171 CVE-2016-5172 CVE-2016-5181 CVE-2016-5185 CVE-2016-5186 CVE-2016-5187 CVE-2016-5188 CVE-2016-5192 CVE-2016-5198 Package : qt5-webengine Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qt5-webengine before version 5.7.1-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, cross-site scripting, information disclosure and same-origin policy bypass. Resolution ========== Upgrade to 5.7.1-1. # pacman -Syu "qt5-webengine>=5.7.1-1" The problems have been fixed upstream in version 5.7.1. Workaround ========== None. Description =========== - CVE-2016-5133 (content spoofing) Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. - CVE-2016-5147 (cross-site scripting) Blink, as used in Google Chrome, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." - CVE-2016-5153 (arbitrary code execution) The Web Animations implementation in Blink improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site. - CVE-2016-5155 (content spoofing) Chromium does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site. - CVE-2016-5161 (information disclosure) The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class. - CVE-2016-5166 (information disclosure) The download implementation in Chromium does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice. - CVE-2016-5170 (arbitrary code execution) WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after- free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls. - CVE-2016-5171 (arbitrary code execution) WebKit/Source/bindings/templates/interface.cpp in Blink does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. - CVE-2016-5172 (information disclosure) The parser in Google V8 mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. - CVE-2016-5181 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5185 (arbitrary code execution) An use after free flaw was found in the Blink component of the Chromium browser. - CVE-2016-5186 (information disclosure) An out of bounds read flaw was found in the DevTools component of the Chromium browser. - CVE-2016-5187 (content spoofing) An URL spoofing flaw was found in the Chromium browser. - CVE-2016-5188 (content spoofing) An UI spoofing flaw was found in the Chromium browser. - CVE-2016-5192 (same-origin policy bypass) A cross-origin bypass flaw was found in the Blink component of the Chromium browser. - CVE-2016-5198 (arbitrary code execution) An out of bounds memory access flaw was found in the V8 component of the Chromium browser. Impact ====== A remote attacker can access sensitive information, spoof content, bypass security measures or execute arbitrary code on the affected host. References ========== https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.7.1?h=5.7 https://bugs.chromium.org/p/chromium/issues/detail?id=613626 https://bugs.chromium.org/p/chromium/issues/detail?id=628942 https://bugs.chromium.org/p/chromium/issues/detail?id=631052 https://bugs.chromium.org/p/chromium/issues/detail?id=630662 https://bugzilla.redhat.com/show_bug.cgi?id=1372216 https://bugs.chromium.org/p/chromium/issues/detail?id=622420 https://bugs.chromium.org/p/chromium/issues/detail?id=616429 https://bugs.chromium.org/p/chromium/issues/detail?id=641101 https://bugs.chromium.org/p/chromium/issues/detail?id=643357 https://chromereleases.googleblog.com/2016/09/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=616386 https://googlechromereleases.blogspot.fr/2016/10/stable-channel-update-for-… https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=659475 https://access.redhat.com/security/cve/CVE-2016-5133 https://access.redhat.com/security/cve/CVE-2016-5147 https://access.redhat.com/security/cve/CVE-2016-5153 https://access.redhat.com/security/cve/CVE-2016-5155 https://access.redhat.com/security/cve/CVE-2016-5161 https://access.redhat.com/security/cve/CVE-2016-5166 https://access.redhat.com/security/cve/CVE-2016-5170 https://access.redhat.com/security/cve/CVE-2016-5171 https://access.redhat.com/security/cve/CVE-2016-5172 https://access.redhat.com/security/cve/CVE-2016-5181 https://access.redhat.com/security/cve/CVE-2016-5185 https://access.redhat.com/security/cve/CVE-2016-5186 https://access.redhat.com/security/cve/CVE-2016-5187 https://access.redhat.com/security/cve/CVE-2016-5188 https://access.redhat.com/security/cve/CVE-2016-5192 https://access.redhat.com/security/cve/CVE-2016-5198

1 0

[arch-security] [ASA-201612-17] lib32-flashplugin: multiple issues
by Levente Polyak 15 Dec '16

15 Dec '16

Arch Linux Security Advisory ASA-201612-17 ========================================== Severity: Critical Date : 2016-12-15 CVE-ID : CVE-2016-7867 CVE-2016-7868 CVE-2016-7869 CVE-2016-7870 CVE-2016-7871 CVE-2016-7872 CVE-2016-7873 CVE-2016-7874 CVE-2016-7875 CVE-2016-7876 CVE-2016-7877 CVE-2016-7878 CVE-2016-7879 CVE-2016-7880 CVE-2016-7881 CVE-2016-7890 CVE-2016-7892 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 24.0.0.186-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 24.0.0.186-1. # pacman -Syu "lib32-flashplugin>=24.0.0.186-1" The problems have been fixed upstream in version 24.0.0.186. Workaround ========== None. Description =========== - CVE-2016-7867 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7868 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7869 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7870 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7871 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7872 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7873 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7874 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7875 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7876 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7877 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7878 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7879 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7880 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7881 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7890 (access restriction bypass) A security bypass vulnerability has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7892 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. Impact ====== A remote attacker is able to bypass certain security restrictions and execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-39.html https://access.redhat.com/security/cve/CVE-2016-7867 https://access.redhat.com/security/cve/CVE-2016-7868 https://access.redhat.com/security/cve/CVE-2016-7869 https://access.redhat.com/security/cve/CVE-2016-7870 https://access.redhat.com/security/cve/CVE-2016-7871 https://access.redhat.com/security/cve/CVE-2016-7872 https://access.redhat.com/security/cve/CVE-2016-7873 https://access.redhat.com/security/cve/CVE-2016-7874 https://access.redhat.com/security/cve/CVE-2016-7875 https://access.redhat.com/security/cve/CVE-2016-7876 https://access.redhat.com/security/cve/CVE-2016-7877 https://access.redhat.com/security/cve/CVE-2016-7878 https://access.redhat.com/security/cve/CVE-2016-7879 https://access.redhat.com/security/cve/CVE-2016-7880 https://access.redhat.com/security/cve/CVE-2016-7881 https://access.redhat.com/security/cve/CVE-2016-7890 https://access.redhat.com/security/cve/CVE-2016-7892

1 0

[arch-security] [ASA-201612-16] flashplugin: multiple issues
by Levente Polyak 15 Dec '16

15 Dec '16

Arch Linux Security Advisory ASA-201612-16 ========================================== Severity: Critical Date : 2016-12-15 CVE-ID : CVE-2016-7867 CVE-2016-7868 CVE-2016-7869 CVE-2016-7870 CVE-2016-7871 CVE-2016-7872 CVE-2016-7873 CVE-2016-7874 CVE-2016-7875 CVE-2016-7876 CVE-2016-7877 CVE-2016-7878 CVE-2016-7879 CVE-2016-7880 CVE-2016-7881 CVE-2016-7890 CVE-2016-7892 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 24.0.0.186-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 24.0.0.186-1. # pacman -Syu "flashplugin>=24.0.0.186-1" The problems have been fixed upstream in version 24.0.0.186. Workaround ========== None. Description =========== - CVE-2016-7867 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7868 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7869 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7870 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7871 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7872 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7873 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7874 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7875 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7876 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7877 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7878 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7879 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7880 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7881 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7890 (access restriction bypass) A security bypass vulnerability has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7892 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. Impact ====== A remote attacker is able to bypass certain security restrictions and execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-39.html https://access.redhat.com/security/cve/CVE-2016-7867 https://access.redhat.com/security/cve/CVE-2016-7868 https://access.redhat.com/security/cve/CVE-2016-7869 https://access.redhat.com/security/cve/CVE-2016-7870 https://access.redhat.com/security/cve/CVE-2016-7871 https://access.redhat.com/security/cve/CVE-2016-7872 https://access.redhat.com/security/cve/CVE-2016-7873 https://access.redhat.com/security/cve/CVE-2016-7874 https://access.redhat.com/security/cve/CVE-2016-7875 https://access.redhat.com/security/cve/CVE-2016-7876 https://access.redhat.com/security/cve/CVE-2016-7877 https://access.redhat.com/security/cve/CVE-2016-7878 https://access.redhat.com/security/cve/CVE-2016-7879 https://access.redhat.com/security/cve/CVE-2016-7880 https://access.redhat.com/security/cve/CVE-2016-7881 https://access.redhat.com/security/cve/CVE-2016-7890 https://access.redhat.com/security/cve/CVE-2016-7892

1 0

[arch-security] [ASA-201612-15] firefox: multiple issues
by Remi Gacogne 14 Dec '16

14 Dec '16

Arch Linux Security Advisory ASA-201612-15 ========================================== Severity: Critical Date : 2016-12-14 CVE-ID : CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9903 CVE-2016-9904 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 50.1.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure, content spoofing, cross-site scripting and insufficient validation. Resolution ========== Upgrade to 50.1.0-1. # pacman -Syu "firefox>=50.1.0-1" The problems have been fixed upstream in version 50.1.0. Workaround ========== None. Description =========== - CVE-2016-9080 (arbitrary code execution) Mozilla developers and community members Kan-Ru Chen, Christian Holler, and Tyson Smith reported memory safety bugs present in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2016-9893 (arbitrary code execution) Mozilla developers and community members Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky reported memory safety bugs present in Firefox 50.0.2 and Firefox ESR 45.5.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2016-9894 (arbitrary code execution) A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. - CVE-2016-9895 (access restriction bypass) Event handlers on marquee elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. - CVE-2016-9896 (arbitrary code execution) Use-after-free while manipulating the navigator object within WebVR. Note: WebVR is not currently enabled by default. - CVE-2016-9897 (arbitrary code execution) Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. - CVE-2016-9898 (arbitrary code execution) Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. - CVE-2016-9899 (arbitrary code execution) Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. - CVE-2016-9900 (information disclosure) External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of data: URLs. This could allow for cross-domain data leakage. - CVE-2016-9901 (insufficient validation) HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the about:pocket-saved (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. - CVE-2016-9902 (content spoofing) The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. - CVE-2016-9903 (cross-site scripting) Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. - CVE-2016-9904 (information disclosure) An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. Impact ====== A remote attacker can access sensitive information, bypass security measures and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9080 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9893 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9894 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9895 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9896 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9897 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9898 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9899 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9900 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9901 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9902 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9903 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9904 https://access.redhat.com/security/cve/CVE-2016-9080 https://access.redhat.com/security/cve/CVE-2016-9893 https://access.redhat.com/security/cve/CVE-2016-9894 https://access.redhat.com/security/cve/CVE-2016-9895 https://access.redhat.com/security/cve/CVE-2016-9896 https://access.redhat.com/security/cve/CVE-2016-9897 https://access.redhat.com/security/cve/CVE-2016-9898 https://access.redhat.com/security/cve/CVE-2016-9899 https://access.redhat.com/security/cve/CVE-2016-9900 https://access.redhat.com/security/cve/CVE-2016-9901 https://access.redhat.com/security/cve/CVE-2016-9902 https://access.redhat.com/security/cve/CVE-2016-9903 https://access.redhat.com/security/cve/CVE-2016-9904

1 0

[arch-security] [ASA-201612-14] linux-zen: denial of service
by Santiago Torres-Arias 13 Dec '16

13 Dec '16

Arch Linux Security Advisory ASA-201612-14 ========================================== Severity: High Date : 2016-12-12 CVE-ID : CVE-2016-9919 Package : linux-zen Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-zen before version 4.8.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.8.13-1. # pacman -Syu "linux-zen>=4.8.13-1" The problem has been fixed upstream in version 4.8.13. Workaround ========== None. Description =========== The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Impact ====== A remote attacker can cause a kernel panic by sending a fragmented IPv6 packet. References ========== https://bugzilla.kernel.org/show_bug.cgi?id=189851 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-9919

1 0

[arch-security] [ASA-201612-13] python-html5lib: cross-site scripting
by Santiago Torres-Arias 13 Dec '16

13 Dec '16

Arch Linux Security Advisory ASA-201612-13 ========================================== Severity: Low Date : 2016-12-12 CVE-ID : CVE-2016-9909 CVE-2016-9910 Package : python-html5lib Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-html5lib before version 0.999999999-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 0.999999999-1. # pacman -Syu "python-html5lib>=0.999999999-1" The problems have been fixed upstream in version 0.999999999. Workaround ========== None. Description =========== - CVE-2016-9909 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. - CVE-2016-9910 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. Impact ====== A remote attacker is able to execute arbitrary javascript in certain legacy browsers. References ========== http://www.openwall.com/lists/oss-security/2016/12/06/5 https://github.com/html5lib/html5lib-python/issues/11 https://github.com/html5lib/html5lib-python/issues/12 https://access.redhat.com/security/cve/CVE-2016-9909 https://access.redhat.com/security/cve/CVE-2016-9910

1 0

[arch-security] [ASA-201612-12] python2-html5lib: cross-site scripting
by Santiago Torres-Arias 13 Dec '16

13 Dec '16

Arch Linux Security Advisory ASA-201612-12 ========================================== Severity: Low Date : 2016-12-12 CVE-ID : CVE-2016-9909 CVE-2016-9910 Package : python2-html5lib Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-html5lib before version 0.999999999-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 0.999999999-1. # pacman -Syu "python2-html5lib>=0.999999999-1" The problems have been fixed upstream in version 0.999999999. Workaround ========== None. Description =========== - CVE-2016-9909 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. - CVE-2016-9910 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. Impact ====== A remote attacker is able to execute arbitrary javascript in certain legacy browsers. References ========== http://www.openwall.com/lists/oss-security/2016/12/06/5 https://github.com/html5lib/html5lib-python/issues/11 https://github.com/html5lib/html5lib-python/issues/12 https://access.redhat.com/security/cve/CVE-2016-9909 https://access.redhat.com/security/cve/CVE-2016-9910

1 0