December 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201612-11] linux-grsec: denial of service
by Remi Gacogne 10 Dec '16

10 Dec '16

Arch Linux Security Advisory ASA-201612-11 ========================================== Severity: High Date : 2016-12-10 CVE-ID : CVE-2016-9919 Package : linux-grsec Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-grsec before version 1:4.8.12.r201612062306-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1:4.8.12.r201612062306-2. # pacman -Syu "linux-grsec>=1:4.8.12.r201612062306-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Impact ====== A remote attacker can cause a kernel panic by sending a fragmented IPv6 packet. References ========== https://bugzilla.kernel.org/show_bug.cgi?id=189851 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-9919

2 1

[arch-security] [ASA-201612-10] linux: denial of service
by Remi Gacogne 10 Dec '16

10 Dec '16

Arch Linux Security Advisory ASA-201612-10 ========================================== Severity: High Date : 2016-12-10 CVE-ID : CVE-2016-9919 Package : linux Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.8.12-3 is vulnerable to denial of service. Resolution ========== Upgrade to 4.8.12-3. # pacman -Syu "linux>=4.8.12-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Impact ====== A remote attacker can cause a kernel panic by sending a fragmented IPv6 packet. References ========== https://bugzilla.kernel.org/show_bug.cgi?id=189851 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-9919

1 0

[arch-security] [ASA-201612-9] jasper: multiple issues
by Levente Polyak 09 Dec '16

09 Dec '16

Arch Linux Security Advisory ASA-201612-9 ========================================= Severity: Critical Date : 2016-12-07 CVE-ID : CVE-2015-5203 CVE-2015-8751 CVE-2016-2089 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692 CVE-2016-8693 CVE-2016-8884 CVE-2016-8885 CVE-2016-8887 CVE-2016-9262 CVE-2016-9387 CVE-2016-9388 CVE-2016-9557 CVE-2016-9560 Package : jasper Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.31-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.31-1. # pacman -Syu "jasper>=1.900.31-1" The problems have been fixed upstream in version 1.900.31. Workaround ========== None. Description =========== - CVE-2015-5203 (arbitrary code execution) A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or possibly execute arbitrary code. - CVE-2015-8751 (denial of service) An integer overflow flaw was found in the way the JasPer's library jas_matrix_create() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. - CVE-2016-2089 (denial of service) The jas_matrix_clip function in jas_seq.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. - CVE-2016-8690 (denial of service) A null pointer dereference vulnerability was found in bmp_getdata triggered by invoking imginfo command on specially crafted BMP image. - CVE-2016-8691 (denial of service) A division by zero vulnerability was found in jpc_dec_process_siz triggered by invoking imginfo command on specially crafted file. - CVE-2016-8692 (denial of service) A division by zero vulnerability was found in jpc_dec_process_siz triggered by invoking imginfo command on specially crafted file. - CVE-2016-8693 (denial of service) A double free vulnerability was found in mem_close in jas_stream.c triggered by invoking imginfo command on specially crafted image file. - CVE-2016-8884 (denial of service) A null pointer dereference vulnerability has been discovered in bmp_getdata in bmp_dec.c. - CVE-2016-8885 (denial of service) A null pointer dereference vulnerability has been discovered in bmp_getdata in bmp_dec.c. - CVE-2016-8887 (denial of service) A null pointer dereference vulnerability was found in jp2_colr_destroy in jp2_cod.c leading to application crash. - CVE-2016-9262 (arbitrary code execution) A number of overflows were found in jasper causing use after free vulnerability triggered by a crafted image. - CVE-2016-9387 (denial of service) An integer overflow in jpc_dec_process_siz was found that can be triggered by crafted image file when given as input to imginfo. - CVE-2016-9388 (denial of service) An improper error handling was found in the RAS encoder/decoder triggering assertion tests that result in denial of service. - CVE-2016-9557 (denial of service) A signed integer overflow vulnerability has been discovered in jas_image.c triggered by a crafted image. An option max_samples has been added to the BMP and JPEG decoders to restrict the maximum size of image that they can decode. This change was made as a (possibly temporary) fix to address security concerns. - CVE-2016-9560 (arbitrary code execution) A stack buffer overflow vulnerability has been discovered in jpc/jpc_dec.c duo to an out of bounds array write triggered by a crafted image. Impact ====== A remote attacker is able to perform a denial of service attack or execute arbitrary code on the affected host. References ========== http://seclists.org/oss-sec/2015/q3/366 https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c3 http://seclists.org/oss-sec/2016/q1/44 https://bugzilla.redhat.com/show_bug.cgi?id=1294039 http://www.openwall.com/lists/oss-security/2016/10/16/14 https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference… https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c80… https://github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183… https://github.com/mdadams/jasper/commit/44a524e367597af58d6265ae2014468b33… https://github.com/mdadams/jasper/commit/5d66894d2313e3f3469f19066 http://seclists.org/oss-sec/2016/q4/213 https://github.com/mdadams/jasper/commit/e24bdc716c3327b067c551bc6cfb97fd23… http://seclists.org/oss-sec/2016/q4/215 https://github.com/mdadams/jasper/commit/634ce8e8a5accc0fa05dd2 http://seclists.org/oss-sec/2016/q4/385 https://github.com/mdadams/jasper/commit/d91198abd00fc435a397fe6bad906a4c17… http://seclists.org/oss-sec/2016/q4/441 https://github.com/mdadams/jasper/commit/411a4068f8c464e883358bf403a3e25158… https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151… http://www.openwall.com/lists/oss-security/2016/11/23/2 https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df1… http://www.openwall.com/lists/oss-security/2016/11/23/5 https://access.redhat.com/security/cve/CVE-2015-5203 https://access.redhat.com/security/cve/CVE-2015-8751 https://access.redhat.com/security/cve/CVE-2016-2089 https://access.redhat.com/security/cve/CVE-2016-8690 https://access.redhat.com/security/cve/CVE-2016-8691 https://access.redhat.com/security/cve/CVE-2016-8692 https://access.redhat.com/security/cve/CVE-2016-8693 https://access.redhat.com/security/cve/CVE-2016-8884 https://access.redhat.com/security/cve/CVE-2016-8885 https://access.redhat.com/security/cve/CVE-2016-8887 https://access.redhat.com/security/cve/CVE-2016-9262 https://access.redhat.com/security/cve/CVE-2016-9387 https://access.redhat.com/security/cve/CVE-2016-9388 https://access.redhat.com/security/cve/CVE-2016-9557 https://access.redhat.com/security/cve/CVE-2016-9560

1 0

[arch-security] [ASA-201612-8] linux-zen: privilege escalation
by Levente Polyak 09 Dec '16

09 Dec '16

Arch Linux Security Advisory ASA-201612-8 ========================================= Severity: High Date : 2016-12-07 CVE-ID : CVE-2016-8655 Package : linux-zen Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-zen before version 4.8.12-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8.12-2. # pacman -Syu "linux-zen>=4.8.12-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKET_V3 ring buffer. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system. Impact ====== A local attacker with CAP_NET_RAW capabilities is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-7] linux-lts: privilege escalation
by Levente Polyak 06 Dec '16

06 Dec '16

Arch Linux Security Advisory ASA-201612-7 ========================================= Severity: High Date : 2016-12-06 CVE-ID : CVE-2016-8655 Package : linux-lts Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before version 4.4.36-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.4.36-1. # pacman -Syu "linux-lts>=4.4.36-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Impact ====== A local unprivileged attacker is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-6] linux: privilege escalation
by Levente Polyak 06 Dec '16

06 Dec '16

Arch Linux Security Advisory ASA-201612-6 ========================================= Severity: High Date : 2016-12-06 CVE-ID : CVE-2016-8655 Package : linux Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.8.12-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8.12-2. # pacman -Syu "linux>=4.8.12-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Impact ====== A local unprivileged attacker is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-5] linux-grsec: privilege escalation
by Levente Polyak 06 Dec '16

06 Dec '16

Arch Linux Security Advisory ASA-201612-5 ========================================= Severity: High Date : 2016-12-06 CVE-ID : CVE-2016-8655 Package : linux-grsec Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-grsec before version 1:4.8.12.r201612031658-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:4.8.12.r201612031658-2. # pacman -Syu "linux-grsec>=1:4.8.12.r201612031658-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Impact ====== A local unprivileged attacker is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-4] libdwarf: multiple issues
by Christian Rebischke 04 Dec '16

04 Dec '16

Arch Linux Security Advisory ASA-201612-4 ========================================= Severity: High Date : 2016-12-03 CVE-ID : CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5035 CVE-2016-5037 CVE-2016-5040 CVE-2016-5041 CVE-2016-5043 CVE-2016-5044 CVE-2016-7510 CVE-2016-7511 CVE-2016-8679 CVE-2016-8680 CVE-2016-8681 CVE-2016-9275 CVE-2016-9276 CVE-2016-9480 CVE-2016-9558 Package : libdwarf Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libdwarf before version 20161124-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 20161124-1. # pacman -Syu "libdwarf>=20161124-1" The problems have been fixed upstream in version 20161124. Workaround ========== None. Description =========== - CVE-2016-5027 (denial of service) A vulnerability was found in libdwarf. A malicious object with data all-bits-on could bypass length checks which results in an out-of- bounds read. - CVE-2016-5028 (denial of service) A null pointer dereference vulnerability was found in libdwarf. It exists due to a corrupted object file. Libdwarf was not dealing with empty (bss-like) sections since it really did not expect to see such in sections it reads. - CVE-2016-5029 (denial of service) A null pointer dereference vulnerability was found in libdwarf in create_fullest_file_path() function. This is due to corrupted dwarf and the fix detects this corruption and if that null string pointer happens undetected a static string is substituted so readers can notice the situation. - CVE-2016-5030 (denial of service) A null pointer dereference vulnerability was found in libdwarf in _dwarf_calculate_info_section_end_ptr() function. - CVE-2016-5031 (information disclosure) An out-of-bounds read vulnerability was found in libdwarf in print_frame_inst_bytes() function. - CVE-2016-5032 (information disclosure) An out-of-bounds read vulnerability was found in libdwarf in dwarf_get_xu_hash_entry() function. - CVE-2016-5033 (information disclosure) An out-of-bounds read vulnerability was found in libdwarf in print_exprloc_content. - CVE-2016-5035 (information disclosure) An out-of-bounds read vulnerability was found in dwarf_line_table_reader.c. - CVE-2016-5037 (denial of service) A null pointer dereference vulnerability was found in _dwarf_load_section. - CVE-2016-5040 (denial of service) A vulnerability was found in libdwarf. If the data read for a compilation unit header contains a too large length value the library will read outside of its bounds and crash the application. - CVE-2016-5041 (denial of service) A vulnerability was found in libdwarf. If no DW_AT_name is present in a debugging information entry using DWARF5 macros a null dereference in dwarf_macro5.c will crash the application. - CVE-2016-5043 (information disclosure) A vulnerability was found in libdwarf. A function dwarf_dealloc() did not check the Dwarf_Ptr space argument before using it which leads to an out-of-bounds read. - CVE-2016-5044 (arbitrary code execution) A vulnerability was found in libdwarf in dwarf_elf_access.c:1071. A crafted ELF file may lead to a large offset value, which bigger than the size of target_section heap chunk, then this WRITE_UNALIGNED() function will write the value of &outval out of the heap chunk. The offset is a 64bit unsigned int value, so this is more than a heap overflow bug, but also a out-of-bound write bug. - CVE-2016-7510 (information disclosure) An out-of-bounds read vulnerability was found in read_line_table_program() in libdwarf. - CVE-2016-7511 (denial of service) An integer overflow vulnerability was found in dwarf_die_deliv.c causing segmentation fault. - CVE-2016-8679 (information disclosure) An out of bounds heap read vulnerability was found in _dwarf_get_size_of_val triggered by invoking dwarfdump command on crafted file. - CVE-2016-8680 (information disclosure) An out of bounds heap read vulnerability was found in _dwarf_get_abbrev_for_code triggered by invoking dwarfdump command on crafted file. - CVE-2016-8681 (information disclosure) An out of bounds heap read vulnerability was found in _dwarf_get_abbrev_for_code triggered by invoking dwarfdump command on crafted file. - CVE-2016-9275 (information disclosure) An out of bounds heap read was found in _dwarf_skim_forms in dwarf_macro5.c triggered by crafted input to dwarfdump utility. - CVE-2016-9276 (information disclosure) An out of bounds heap read was found in dwarf_get_aranges_list in dwarf_arrange.c triggered by crafted input to dwarfdump utility. - CVE-2016-9480 (information disclosure) libdwarf allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component. - CVE-2016-9558 (denial of service) A negation overflow vulnerability was found in dwarf_leb.c triggered by crafted input to dwarfdump utility. Impact ====== An attacker could obtain sensitive information, execute arbitrary code or crash the application. References ========== https://blogs.gentoo.org/ago/2016/11/19/libdwarf-negation-overflow-in-dwarf… https://blogs.gentoo.org/ago/2016/11/07/libdwarf-heap-based-buffer-overflow… http://seclists.org/oss-sec/2016/q2/393 https://sourceforge.net/p/libdwarf/code/ci/a55b958926cc67f89a512ed30bb5a22b… https://sourceforge.net/p/libdwarf/code/ci/acae971371daa23a19358bc62204007d… https://sourceforge.net/p/libdwarf/code/ci/6fa3f710ee6f21bba7966b963033a91d… https://sourceforge.net/p/libdwarf/code/ci/ac6673e32f3443a5d36c2217cb814000… https://sourceforge.net/p/libdwarf/code/ci/82d8e007851805af0dcaaff41f49a2d4… https://sourceforge.net/p/libdwarf/code/ci/b6ec2dfd850929821626ea63fb0a7520… https://sourceforge.net/p/libdwarf/code/ci/98a3da1e8237fe0d45b67ef77f3fa5ed… https://sourceforge.net/p/libdwarf/bugs/3/ https://sourceforge.net/p/libdwarf/code/ci/2d14a7792889e33bc542c28d0f379296… https://sourceforge.net/p/libdwarf/code/ci/efe48cad0693d6994d9a7b561e1c3833… http://seclists.org/oss-sec/2016/q4/144 https://sourceforge.net/p/libdwarf/code/ci/268c1f18d1d28612af3b72d7c670076b… http://seclists.org/oss-sec/2016/q4/145 http://seclists.org/oss-sec/2016/q4/146 https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e1… http://seclists.org/oss-sec/2016/q4/401 https://github.com/asarubbo/poc/blob/master/00026-libdwarf-heapoverflow-dwa… https://sourceforge.net/p/libdwarf/code/ci/5dd64de047cd5ec479fb11fe7ff2692f… https://sourceforge.net/p/libdwarf/bugs/5/ https://www.prevanders.net/dwarfbug.html https://access.redhat.com/security/cve/CVE-2016-5027 https://access.redhat.com/security/cve/CVE-2016-5028 https://access.redhat.com/security/cve/CVE-2016-5029 https://access.redhat.com/security/cve/CVE-2016-5030 https://access.redhat.com/security/cve/CVE-2016-5031 https://access.redhat.com/security/cve/CVE-2016-5032 https://access.redhat.com/security/cve/CVE-2016-5033 https://access.redhat.com/security/cve/CVE-2016-5035 https://access.redhat.com/security/cve/CVE-2016-5037 https://access.redhat.com/security/cve/CVE-2016-5040 https://access.redhat.com/security/cve/CVE-2016-5041 https://access.redhat.com/security/cve/CVE-2016-5043 https://access.redhat.com/security/cve/CVE-2016-5044 https://access.redhat.com/security/cve/CVE-2016-7510 https://access.redhat.com/security/cve/CVE-2016-7511 https://access.redhat.com/security/cve/CVE-2016-8679 https://access.redhat.com/security/cve/CVE-2016-8680 https://access.redhat.com/security/cve/CVE-2016-8681 https://access.redhat.com/security/cve/CVE-2016-9275 https://access.redhat.com/security/cve/CVE-2016-9276 https://access.redhat.com/security/cve/CVE-2016-9480 https://access.redhat.com/security/cve/CVE-2016-9558

1 0

[arch-security] [ASA-201612-3] chromium: multiple issues
by Levente Polyak 04 Dec '16

04 Dec '16

Arch Linux Security Advisory ASA-201612-3 ========================================= Severity: Critical Date : 2016-12-03 CVE-ID : CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5209 CVE-2016-5210 CVE-2016-5211 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214 CVE-2016-5215 CVE-2016-5216 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5220 CVE-2016-5221 CVE-2016-5222 CVE-2016-5223 CVE-2016-5224 CVE-2016-5225 CVE-2016-5226 CVE-2016-9650 CVE-2016-9651 CVE-2016-9652 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 55.0.2883.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, arbitrary filesystem access, cross-site scripting, same-origin policy bypass, content spoofing, insufficient validation and information disclosure. Resolution ========== Upgrade to 55.0.2883.75-1. # pacman -Syu "chromium>=55.0.2883.75-1" The problems have been fixed upstream in version 55.0.2883.75. Workaround ========== None. Description =========== - CVE-2016-5203 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5204 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5205 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5206 (same-origin policy bypass) A same-origin bypass flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5207 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5208 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5209 (arbitrary code execution) An out of bounds write flaw was found in the Blink component of the Chromium browser. - CVE-2016-5210 (arbitrary code execution) An out of bounds write flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5211 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5212 (arbitrary filesystem access) A local file disclosure flaw was found in the DevTools component of the Chromium browser. - CVE-2016-5213 (arbitrary code execution) An use after free flaw was found in the V8 component of the Chromium browser. - CVE-2016-5214 (insufficient validation) A file download protection bypass was discovered in the Chromium browser. - CVE-2016-5215 (arbitrary code execution) An use after free flaw was found in the Webaudio component of the Chromium browser. - CVE-2016-5216 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5217 (insufficient validation) An use of unvalidated data flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5218 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2016-5219 (arbitrary code execution) An use after free flaw was found in the V8 component of the Chromium browser. - CVE-2016-5220 (arbitrary filesystem access) A local file access flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5221 (arbitrary code execution) An integer overflow flaw was found in the ANGLE component of the Chromium browser. - CVE-2016-5222 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2016-5223 (arbitrary code execution) An integer overflow flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5224 (same-origin policy bypass) A same-origin bypass flaw was found in the SVG component of the Chromium browser. - CVE-2016-5225 (access restriction bypass) A CSP bypass flaw was found in the Blink component of the Chromium browser. - CVE-2016-5226 (cross-site scripting) A limited XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-9650 (information disclosure) A CSP referrer disclosure vulnerability has been discovered in the Chromium browser. - CVE-2016-9651 (access restriction bypass) A private property access flaw was found in the V8 component of the Chromium browser. - CVE-2016-9652 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass various restrictions, access sensitive information, spoof certain content or execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/12/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5203 https://access.redhat.com/security/cve/CVE-2016-5204 https://access.redhat.com/security/cve/CVE-2016-5205 https://access.redhat.com/security/cve/CVE-2016-5206 https://access.redhat.com/security/cve/CVE-2016-5207 https://access.redhat.com/security/cve/CVE-2016-5208 https://access.redhat.com/security/cve/CVE-2016-5209 https://access.redhat.com/security/cve/CVE-2016-5210 https://access.redhat.com/security/cve/CVE-2016-5211 https://access.redhat.com/security/cve/CVE-2016-5212 https://access.redhat.com/security/cve/CVE-2016-5213 https://access.redhat.com/security/cve/CVE-2016-5214 https://access.redhat.com/security/cve/CVE-2016-5215 https://access.redhat.com/security/cve/CVE-2016-5216 https://access.redhat.com/security/cve/CVE-2016-5217 https://access.redhat.com/security/cve/CVE-2016-5218 https://access.redhat.com/security/cve/CVE-2016-5219 https://access.redhat.com/security/cve/CVE-2016-5220 https://access.redhat.com/security/cve/CVE-2016-5221 https://access.redhat.com/security/cve/CVE-2016-5222 https://access.redhat.com/security/cve/CVE-2016-5223 https://access.redhat.com/security/cve/CVE-2016-5224 https://access.redhat.com/security/cve/CVE-2016-5225 https://access.redhat.com/security/cve/CVE-2016-5226 https://access.redhat.com/security/cve/CVE-2016-9650 https://access.redhat.com/security/cve/CVE-2016-9651 https://access.redhat.com/security/cve/CVE-2016-9652

1 0

[arch-security] [ASA-201612-2] thunderbird: arbitrary code execution
by Santiago Torres-Arias 01 Dec '16

01 Dec '16

Arch Linux Security Advisory ASA-201612-2 ========================================= Severity: Critical Date : 2016-12-01 CVE-ID : CVE-2016-9079 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.5.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.5.1-1. # pacman -Syu "thunderbird>=45.5.1-1" The problem has been fixed upstream in version 45.5.1. Workaround ========== None Description =========== A use-after-free vulnerability has been discovered in the SVG Animation component of Firefox, leading to arbitrary code execution. Impact ====== A remote attacker is able to execute arbitrary code by embedding a crafted SVG image in content displayed by Thunderbird. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/ https://access.redhat.com/security/cve/CVE-2016-9079

1 0