February 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201602-15] lib32-glibc: multiple issues
by Levente Polyak 17 Feb '16

17 Feb '16

Arch Linux Security Advisory ASA-201602-15 ========================================== Severity: Critical Date : 2016-02-17 CVE-ID : CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Package : lib32-glibc Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.22-4 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and denial of service. It is advised to restart all services that may perform DNS lookups. Resolution ========== Upgrade to 2.22-4. # pacman -Syu "lib32-glibc>=2.22-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-7547 (arbitrary code execution) A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module. - CVE-2015-8776 (information disclosure) It was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information. - CVE-2015-8777 (restriction bypass) LD_POINTER_GUARD was an environment variable which controls security-related behavior, but was not ignored for privileged binaries (in AT_SECURE mode). This might allow local attackers (who can supply the environment variable) to bypass intended security restrictions. - CVE-2015-8778 (arbitrary code execution) An integer overflow in hcreate and hcreate_r which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution. - CVE-2015-8779 (arbitrary code execution) A stack overflow (unbounded alloca) in the catopen function can cause applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. Impact ====== A remote attacker is able to execute arbitrary code, potentially disclosure sensitive information or perform a denial of service attack via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7547 https://access.redhat.com/security/cve/CVE-2015-8776 https://access.redhat.com/security/cve/CVE-2015-8777 https://access.redhat.com/security/cve/CVE-2015-8778 https://access.redhat.com/security/cve/CVE-2015-8779 http://seclists.org/oss-sec/2016/q1/153

1 0

[arch-security] [ASA-201602-14] glibc: multiple issues
by Levente Polyak 17 Feb '16

17 Feb '16

Arch Linux Security Advisory ASA-201602-14 ========================================== Severity: Critical Date : 2016-02-17 CVE-ID : CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Package : glibc Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.22-4 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and denial of service. It is advised to restart all services that may perform DNS lookups. Resolution ========== Upgrade to 2.22-4. # pacman -Syu "glibc>=2.22-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-7547 (arbitrary code execution) A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module. - CVE-2015-8776 (information disclosure) It was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information. - CVE-2015-8777 (restriction bypass) LD_POINTER_GUARD was an environment variable which controls security-related behavior, but was not ignored for privileged binaries (in AT_SECURE mode). This might allow local attackers (who can supply the environment variable) to bypass intended security restrictions. - CVE-2015-8778 (arbitrary code execution) An integer overflow in hcreate and hcreate_r which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution. - CVE-2015-8779 (arbitrary code execution) A stack overflow (unbounded alloca) in the catopen function can cause applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. Impact ====== A remote attacker is able to execute arbitrary code, potentially disclosure sensitive information or perform a denial of service attack via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7547 https://access.redhat.com/security/cve/CVE-2015-8776 https://access.redhat.com/security/cve/CVE-2015-8777 https://access.redhat.com/security/cve/CVE-2015-8778 https://access.redhat.com/security/cve/CVE-2015-8779 http://seclists.org/oss-sec/2016/q1/153

1 0

[arch-security] [ASA-201602-13] nghttp2: denial of service
by Remi Gacogne 13 Feb '16

13 Feb '16

Arch Linux Security Advisory ASA-201602-13 ========================================== Severity: Low Date : 2016-02-13 CVE-ID : CVE-2016-1544 Package : nghttp2 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nghttp2 before version 1.7.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "nghttp2>=1.7.1-1" The problem has been fixed upstream in version 1.7.1. Workaround ========== None. Description =========== HTTP/2 uses HPACK to compress header fields. The basic idea is that HTTP header field is stored in the receiver with the numeric index number. The memory used by this storage is tightly constrained, and it is 4KiB by default. When sender sends the same header field, it just sends the corresponding numeric index number, which is usually 1 or 2 bytes. This means that after sender makes the receiver store the relatively large header field (e.g., 4KiB), and it can send specially crafted HEADERS/CONTINUATION frames which contain a lot of references to the stored header field, sender easily effectively send lots of big header fields to the receiver quite easily. nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage for received header fields, so if the peer performs the procedure described above, they will crash due to out of memory. Impact ====== A remote attacker can cause an application using nghttp2 to allocate a lot of memory by sending specially crafted HTTP/2 frames, causing a denial of service. References ========== https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/ http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1544

1 0

[arch-security] [ASA-201602-12] firefox: same-origin policy bypass
by Remi Gacogne 13 Feb '16

13 Feb '16

Arch Linux Security Advisory ASA-201602-12 ========================================== Severity: High Date : 2016-02-13 CVE-ID : CVE-2016-1949 Package : firefox Type : same-origin policy bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 44.0.2-1 is vulnerable to same-origin policy bypass. Resolution ========== Upgrade to 44.0.2-1. # pacman -Syu "firefox>=44.0.2-1" The problem has been fixed upstream in version 44.0.2. Workaround ========== None. Description =========== Jason Pang of OneSignal reported that service workers intercept responses to plugin network requests made through the browser. Plugins which make security decisions based on the content of network requests can have these decisions subverted if a service worker forges responses to those requests. For example, a forged crossdomain.xml could allow a malicious site to violate the same-origin policy using the Flash plugin. Impact ====== A remote attacker might be able to bypass the same-origin policy and gain access to sensitive information. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/ https://access.redhat.com/security/cve/CVE-2016-1949

1 0

[arch-security] [ASA-201602-11] botan: multiple issues
by Levente Polyak 10 Feb '16

10 Feb '16

Arch Linux Security Advisory ASA-201602-11 ========================================== Severity: Critical Date : 2016-02-10 CVE-ID : CVE-2016-2194 CVE-2016-2195 CVE-2016-2196 Package : botan Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package botan before version 1.11.28-1 is vulnerable to denial of service and arbitrary code execution. Resolution ========== Upgrade to 1.11.28-1. # pacman -Syu "botan>=1.11.28-1" The problems have been fixed upstream in version 1.11.28. Workaround ========== None. Description =========== - CVE-2016-2194 (denial of service) The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression. - CVE-2016-2195 (arbitrary code execution) The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime. The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function. The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution. On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmap’ed region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material. - CVE-2016-2196 (arbitrary code execution) The P-521 reduction function would overwrite zero to one word following the allocated block. This could potentially result in remote code execution or a crash. Impact ====== A remote attacker is able to create specially crafted input that, when processed, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-2194 https://access.redhat.com/security/cve/CVE-2016-2195 https://access.redhat.com/security/cve/CVE-2016-2196 https://botan.randombit.net/security.html#id1

1 0

[arch-security] [ASA-201602-10] kscreenlocker: access restriction bypass
by Levente Polyak 10 Feb '16

10 Feb '16

Arch Linux Security Advisory ASA-201602-10 ========================================== Severity: Medium Date : 2016-02-10 CVE-ID : CVE-2016-2312 Package : kscreenlocker Type : access restriction bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package kscreenlocker before version 5.5.4-2 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 5.5.4-2. # pacman -Syu "kscreenlocker>=5.5.4-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A vulnerability has been discovered in kscreenlocker that is leading to access restriction bypass. Turning all screens off while the lock screen is shown can result in the screen being unlocked when turning a screen on again. Impact ====== A local attacker with physical access to the hardware is able to gain unauthorized access to a locked system. References ========== https://www.kde.org/info/security/advisory-20160209-1.txt https://bugs.kde.org/show_bug.cgi?id=358125 https://bugzilla.opensuse.org/show_bug.cgi?id=964548

1 0

[arch-security] [ASA-201602-9] lib32-libsndfile: multiple issues
by Christian Rebischke 06 Feb '16

06 Feb '16

Arch Linux Security Advisory ASA-201602-8 ========================================= Severity: Medium Date : 2016-02-06 CVE-ID : CVE-2014-9496 CVE-2014-9756 CVE-2015-7805 Package : lib32-libsndfile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-libsndfile before version 1.0.26-1 is vulnerable to multiple issues including denial of service and unspecified impact. Resolution ========== Upgrade to 1.0.26-1. # pacman -Syu "lib32-libsndfile>=1.0.26-1" The problems have been fixed upstream in version 1.0.26. Workaround ========== None. Description =========== - CVE-2014-9496 (unspecified impact) The sd2_parse_rsrc_fork function in sd2.c in lib32-libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read. - CVE-2014-9756 (denial of service) The psf_fwrite function in file_io.c in lib32-libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable. - CVE-2015-7805 (unspecified impact) Heap-based buffer overflow in lib32-libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file. Impact ====== A remote attacker could be able to have unspecified impact on the running application. Furthermore a local attacker is able to crash the running application by causing a divide-by-zero error. References ========== https://access.redhat.com/security/cve/CVE-2014-9496 https://access.redhat.com/security/cve/CVE-2014-9756 https://access.redhat.com/security/cve/CVE-2015-7805

1 0

[arch-security] [ASA-201602-8] libsndfile: multiple issues
by Christian Rebischke 06 Feb '16

06 Feb '16

Arch Linux Security Advisory ASA-201602-8 ========================================= Severity: Medium Date : 2016-02-06 CVE-ID : CVE-2014-9496 CVE-2014-9756 CVE-2015-7805 Package : libsndfile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libsndfile before version 1.0.26-1 is vulnerable to multiple issues including denial of service and unspecified impact. Resolution ========== Upgrade to 1.0.26-1. # pacman -Syu "libsndfile>=1.0.26-1" The problems have been fixed upstream in version 1.0.26. Workaround ========== None. Description =========== - CVE-2014-9496 (unspecified impact) The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read. - CVE-2014-9756 (denial of service) The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable. - CVE-2015-7805 (unspecified impact) Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file. Impact ====== A remote attacker could be able to have unspecified impact on the running application. Furthermore a local attacker is able to crash the running application by causing a divide-by-zero error. References ========== https://access.redhat.com/security/cve/CVE-2014-9496 https://access.redhat.com/security/cve/CVE-2014-9756 https://access.redhat.com/security/cve/CVE-2015-7805

1 0

[arch-security] [ASA-201602-7] libbsd: denial of service
by Christian Rebischke 04 Feb '16

04 Feb '16

Arch Linux Security Advisory ASA-201602-7 ========================================== Severity: Low Date : 2016-02-04 CVE-ID : CVE-2016-2090 Package : libbsd Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libbsd before version 0.8.2-1 is vulnerable to denial of service due to a buffer overflow in the "fgetwln"-function. Resolution ========== Upgrade to 0.8.2-1. # pacman -Syu "libbsd>=0.8.2-1" The problem has been fixed upstream in version 0.8.2. Workaround ========== None. Description =========== - CVE-2016-2090 (buffer overflow) libbsd 0.8.1 and earlier contains a buffer overflow in the function fgetwln(). An "if" checks if it is necessary to reallocate memory in the target buffer. However this check is off by one, therefore an out of bounds write happens. Impact ====== A local attacker might be able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2090 https://bugs.freedesktop.org/show_bug.cgi?id=93881 http://article.gmane.org/gmane.comp.security.oss.general/18715 https://blog.fuzzing-project.org/36-Heap-buffer-overflow-in-fgetwln-functio…

1 0

[arch-security] [ASA-201602-6] lib32-nettle: improper cryptographic calculations
by Levente Polyak 03 Feb '16

03 Feb '16

Arch Linux Security Advisory ASA-201602-6 ========================================= Severity: Medium Date : 2016-02-03 CVE-ID : CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 Package : lib32-nettle Type : improper cryptographic calculations Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-nettle before version 3.2-1 is vulnerable to improper cryptographic calculations with unspecified impact. Resolution ========== Upgrade to 3.2-1. # pacman -Syu "lib32-nettle>=3.2-1" The problems have been fixed upstream in version 3.2-1. Workaround ========== None. Description =========== - CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 (improper cryptographic calculations) It has been discovered that multiple carry propagation bugs are producing wrong results in calculations. They affect the NIST P-256 and P-384 curves. The P-256 bug is in the C code and affects multiple architectures. The P-384 bug is in the assembly code and only affects 64 bit x86. The computation compiles a certain curve point with 1, which should not change the coordinates, however it does. Impact ====== The impact is currently unclear, but miscalculations in cryptographic functions are classified as security issues. References ========== https://access.redhat.com/security/cve/CVE-2015-8803 https://access.redhat.com/security/cve/CVE-2015-8804 https://access.redhat.com/security/cve/CVE-2015-8805 https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scala… https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html

1 0