March 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201603-27] jre8-openjdk-headless: sandbox escape
by Levente Polyak 29 Mar '16

29 Mar '16

Arch Linux Security Advisory ASA-201603-27 ========================================== Severity: Critical Date : 2016-03-29 CVE-ID : CVE-2016-0636 Package : jre8-openjdk-headless Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk-headless before version 8.u77-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 8.u77-1. # pacman -Syu "jre8-openjdk-headless>=8.u77-1" The problem has been fixed upstream in version 8.u77. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0

[arch-security] [ASA-201603-26] jre8-openjdk: sandbox escape
by Levente Polyak 29 Mar '16

29 Mar '16

Arch Linux Security Advisory ASA-201603-26 ========================================== Severity: Critical Date : 2016-03-29 CVE-ID : CVE-2016-0636 Package : jre8-openjdk Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk before version 8.u77-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 8.u77-1. # pacman -Syu "jre8-openjdk>=8.u77-1" The problem has been fixed upstream in version 8.u77. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0

[arch-security] [ASA-201603-25] jdk8-openjdk: sandbox escape
by Levente Polyak 29 Mar '16

29 Mar '16

Arch Linux Security Advisory ASA-201603-25 ========================================== Severity: Critical Date : 2016-03-29 CVE-ID : CVE-2016-0636 Package : jdk8-openjdk Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk8-openjdk before version 8.u77-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 8.u77-1. # pacman -Syu "jdk8-openjdk>=8.u77-1" The problem has been fixed upstream in version 8.u77. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0

[arch-security] [ASA-201603-24] chromium: multiple issues
by Remi Gacogne 26 Mar '16

26 Mar '16

Arch Linux Security Advisory ASA-201603-24 ========================================== Severity: Critical Date : 2016-03-26 CVE-ID : CVE-2016-1646 CVE-2016-1647 CVE-2016-1648 CVE-2016-1649 CVE-2016-1650 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 49.0.2623.108-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 49.0.2623.108-1. # pacman -Syu "chromium>=49.0.2623.108-1" The problem has been fixed upstream in version 49.0.2623.108. Workaround ========== None. Description =========== - CVE-2016-1646: Out-of-bounds read in V8. Credit to Wen Xu from Tencent KeenLab. - CVE-2016-1647: Use-after-free in Navigation. Credit to anonymous. - CVE-2016-1648: Use-after-free in Extensions. Credit to anonymous. - CVE-2016-1649: Buffer overflow in libANGLE. Credit to lokihardt working with HP's Zero Day Initiative / Pwn2Own. - CVE-2016-1650: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can cause a denial of service or have another unspecified impact on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/03/stable-channel-update_24.ht… https://access.redhat.com/security/cve/CVE-2016-1646 https://access.redhat.com/security/cve/CVE-2016-1647 https://access.redhat.com/security/cve/CVE-2016-1648 https://access.redhat.com/security/cve/CVE-2016-1649 https://access.redhat.com/security/cve/CVE-2016-1650

1 0

[arch-security] [ASA-201603-23] expat: arbitrary code execution
by Remi Gacogne 24 Mar '16

24 Mar '16

Arch Linux Security Advisory ASA-201603-23 ========================================== Severity: Critical Date : 2016-03-24 CVE-ID : CVE-2015-1283 Package : expat Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package expat before version 2.1.1-1 is vulnerable to several integer overflows leading to arbitrary code execution. Resolution ========== Upgrade to 2.1.1-1. # pacman -Syu "expat>=2.1.1-1" The problem has been fixed upstream in version 2.1.1. Workaround ========== None. Description =========== Multiple integer overflows in the XML_GetBuffer() function in Expat through 2.1.0 allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. Impact ====== A remote attacker can execute arbitrary code on the affected host by submitting a specially crafted XML file for parsing. Note that Expat is used in several products, some of them accepting untrusted XML files from the network. References ========== https://sourceforge.net/p/expat/bugs/528/ https://access.redhat.com/security/cve/CVE-2015-1283

1 0

[arch-security] [ASA-201603-22] botan: multiple issues
by Remi Gacogne 24 Mar '16

24 Mar '16

Arch Linux Security Advisory ASA-201603-22 ========================================== Severity: High Date : 2016-03-24 CVE-ID : CVE-2016-2849 CVE-2016-2850 Package : botan Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package botan before version 1.11.29-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 1.11.29-1. # pacman -Syu "botan>=1.11.29-1" The problem has been fixed upstream in version 1.11.29. Workaround ========== None. Description =========== - CVE-2016-2849 (ECDSA side channel): ECDSA (and DSA) signature algorithms perform a modular inverse on the signature nonce k. The modular inverse algorithm used had input dependent loops, and it is possible a side channel attack could recover sufficient information about the nonce to eventually recover the ECDSA secret key. Found by Sean Devlin. - CVE-2016-2850 (Failure to enforce TLS policy): TLS v1.2 allows negotiating which signature algorithms and hash functions each side is willing to accept. However received signatures were not actually checked against the specified policy. This had the effect of allowing a server to use an MD5 or SHA-1 signature, even though the default policy prohibits it. The same issue affected client cert authentication. The TLS client also failed to verify that the ECC curve the server chose to use was one which was acceptable by the client policy. Impact ====== A remote attacker might be able to recover an ECDSA secret key by using a side channel attack. A remote attacker can downgrade the TLS signatures and hash functions to vulnerable algorithms like MD5 or SHA-1 even if they are explicitely prohibited. References ========== http://botan.randombit.net/security.html#id1 https://access.redhat.com/security/cve/CVE-2016-2849 https://access.redhat.com/security/cve/CVE-2016-2850

1 0

[arch-security] [ASA-201603-21] thunderbird: multiple issues
by Remi Gacogne 20 Mar '16

20 Mar '16

Arch Linux Security Advisory ASA-201603-21 ========================================== Severity: Critical Date : 2016-03-20 CVE-ID : CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1957 CVE-2016-1960 CVE-2016-1961 CVE-2016-1964 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 38.7.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 38.7.0-1. # pacman -Syu "thunderbird>=38.7.0-1" The problem has been fixed upstream in version 38.7.0. Workaround ========== None. Description =========== - CVE-2016-1952 CVE-2016-1953 (arbitrary code execution): Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-1954 (privilege escalation): Security researcher Nicolas Golubovic reported that a malicious page can overwrite files on the user's machine using Content Security Policy (CSP) violation reports. The file contents are restricted to the JSON format of the report. In many cases overwriting a local file may simply be destructive, breaking the functionality of that file. The CSP error reports can include HTML fragments which could be rendered by browsers. If a user has disabled add-on signing and has installed an "unpacked" add-on, a malicious page could overwrite one of the add-on resources. Depending on how this resource is used, this could lead to privilege escalation. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1957 (resource consumption): Security researchers Jose Martinez and Romina Santillan reported a memory leak in the libstagefright library when array destruction occurs during MPEG4 video file processing. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1960 (arbitrary code execution): Security researcher ca0nguyen, working with HP's Zero Day Initiative, reported a use-after-free issue in the HTML5 string parser when parsing a particular set of table-related tags in a foreign fragment context such as SVG. This results in a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1961 (arbitrary code execution): Security researcher lokihardt, working with HP's Zero Day Initiative, reported a use-after-free issue in the SetBody function of HTMLDocument. This results in a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1964 (arbitrary code execution): Security researcher Nicolas Grégoire used the Address Sanitizer to find a use-after-free during XML transformation operations. This results in a potentially exploitable crash triggerable by web content. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1966 (remote code execution): The Communications Electronics Security Group (UK) of the GCHQ reported a dangling pointer dereference within the Netscape Plugin Application Programming Interface (NPAPI) that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted NPAPI plugin in concert with scripted web content, resulting in a potentially exploitable crash when triggered. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1974 (denial of service): Security researcher Ronald Crane reported an out-of-bounds read following a failed allocation in the HTML parser while working with unicode strings. This can also affect the parsing of XML and SVG format data. This leads to a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 (buffer overflow): Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://www.mozilla.org/en-US/security/advisories/mfsa2016-16/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-17/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-20/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-23/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-24/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-27/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-31/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-34/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/ https://access.redhat.com/security/cve/CVE-2016-1952 https://access.redhat.com/security/cve/CVE-2016-1953 https://access.redhat.com/security/cve/CVE-2016-1954 https://access.redhat.com/security/cve/CVE-2016-1957 https://access.redhat.com/security/cve/CVE-2016-1960 https://access.redhat.com/security/cve/CVE-2016-1961 https://access.redhat.com/security/cve/CVE-2016-1964 https://access.redhat.com/security/cve/CVE-2016-1966 https://access.redhat.com/security/cve/CVE-2016-1974 https://access.redhat.com/security/cve/CVE-2016-1977 https://access.redhat.com/security/cve/CVE-2016-2790 https://access.redhat.com/security/cve/CVE-2016-2791 https://access.redhat.com/security/cve/CVE-2016-2792 https://access.redhat.com/security/cve/CVE-2016-2793 https://access.redhat.com/security/cve/CVE-2016-2794 https://access.redhat.com/security/cve/CVE-2016-2795 https://access.redhat.com/security/cve/CVE-2016-2796 https://access.redhat.com/security/cve/CVE-2016-2797 https://access.redhat.com/security/cve/CVE-2016-2798 https://access.redhat.com/security/cve/CVE-2016-2799 https://access.redhat.com/security/cve/CVE-2016-2800 https://access.redhat.com/security/cve/CVE-2016-2801 https://access.redhat.com/security/cve/CVE-2016-2802

1 0

[arch-security] [ASA-201603-20] git: remote code execution
by Remi Gacogne 20 Mar '16

20 Mar '16

Arch Linux Security Advisory ASA-201603-20 ========================================== Severity: Critical Date : 2016-03-20 CVE-ID : CVE-2016-2324 Package : git Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package git before version 2.7.4-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 2.7.4-1. # pacman -Syu "git>=2.7.4-1" The problem has been fixed upstream in versions 2.4.11, 2.5.5, 2.6.6 and 2.7.4. Workaround ========== None. Description =========== Laël Cellier discovered an integer overflow vulnerability in the path_name() function of git. Impact ====== A remote attacker can execute arbitrary code by crafting a malicious repository and either directly cloning it or getting a local user to clone it. References ========== http://seclists.org/oss-sec/2016/q1/653 https://access.redhat.com/security/cve/CVE-2016-2324

1 0

[arch-security] [ASA-201603-19] dropbear: command injection
by Levente Polyak 14 Mar '16

14 Mar '16

Arch Linux Security Advisory ASA-201603-19 ========================================== Severity: Medium Date : 2016-03-14 CVE-ID : CVE-2016-3116 Package : dropbear Type : command injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package dropbear before version 2016.72-1 is vulnerable to command injection leading to information disclosure, directory traversal and possibly other impact. Resolution ========== Upgrade to 2016.72-1. # pacman -Syu "dropbear>=2016.72-1" The problem has been fixed upstream in version 2016.72. Workaround ========== Set X11Forwarding=no in sshd_config. This is the default. For authorized_keys that specify a "command" restriction, also set the "restrict" or "no-x11-forwarding" restrictions. Description =========== A vulnerability was found in a way dropbear processed X11 forwarding input. By using a specially crafted request, an attacker could bypass the authorized_keys command restrictions. xauth is run under the user's privilege, so this vulnerability offers no additional access to unrestricted accounts, but could circumvent key or account restrictions such as sshd_config ForceCommand, authorized_keys command="..." or restricted shells. Impact ====== A remote authenticated user who is able to request X11 forwarding can inject commands leading to information disclosure, directory traversal and possibly other impact. References ========== https://matt.ucc.asn.au/dropbear/CHANGES https://access.redhat.com/security/cve/CVE-2016-3116

1 0

[arch-security] [ASA-201603-18] pcre: arbitrary code execution
by Levente Polyak 13 Mar '16

13 Mar '16

Arch Linux Security Advisory ASA-201603-18 ========================================== Severity: High Date : 2016-03-13 CVE-ID : CVE-2016-1283 Package : pcre Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.38-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.38-3. # pacman -Syu "pcre>=8.38-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex. Exploits with advanced Heap Fengshui techniques may allow an attacker to execute arbitrary code in the context of the user running the affected application. Impact ====== A remote attacker is able to execute arbitrary code by crafting a special regular expression that triggers a heap buffer overflow. References ========== https://access.redhat.com/security/cve/CVE-2016-1283 https://bugs.exim.org/show_bug.cgi?id=1767 https://bugs.archlinux.org/48484

1 0

[arch-security] [ASA-201603-17] wireshark-gtk: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-17 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-gtk before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-gtk>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-16] wireshark-qt: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-16 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-qt>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-15] wireshark-cli: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-15 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-cli>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing a vulnerable user to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-14] pidgin-otr: arbitrary code execution
by Levente Polyak 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-14 ========================================== Severity: High Date : 2016-03-12 CVE-ID : CVE-2015-8833 Package : pidgin-otr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pidgin-otr before version 4.0.2-1 is vulnerable to use-after-free leading to denial of service or possible arbitrary code execution. Resolution ========== Upgrade to 4.0.2-1. # pacman -Syu "pidgin-otr>=4.0.2-1" The problem has been fixed upstream in version 4.0.2. Workaround ========== None. Description =========== The pidgin-otr plugin fixes a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function create_smp_dialog. This issue is leading to denial of service or possibly remote code execution. Impact ====== A remote attacker is able to trigger a user-after-free during otr authentication and possibly execute arbitrary code References ========== https://access.redhat.com/security/cve/CVE-2015-8833 http://seclists.org/oss-sec/2016/q1/572 https://bugs.otr.im/issues/88 https://bugs.archlinux.org/task/48537

1 0

[arch-security] [ASA-201603-13] bind: denial of service
by Christian Rebischke 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-13 ========================================== Severity: Low Date : 2016-03-12 CVE-ID : CVE-2016-2088 CVE-2016-1286 CVE-2016-1285 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P4-1 . # pacman -Syu "bind>=9.10.3.P4-1" The problem has been fixed upstream in version 9.10.3-P4. Workaround ========== None. Description =========== - CVE-2016-2088 (denial of service) Allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option. - CVE-2016-1286 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. - CVE-2016-1285 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c Impact ====== A remote attacker is able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2088 https://access.redhat.com/security/cve/CVE-2016-1286 https://access.redhat.com/security/cve/CVE-2016-1285 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2088 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1286 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1285

1 0

[arch-security] [ASA-201603-12] openssh: command injection
by Levente Polyak 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-12 ========================================== Severity: Medium Date : 2016-03-11 CVE-ID : CVE-2016-3115 Package : openssh Type : command injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 7.2p2-1 is vulnerable to command injection leading to information disclosure, directory traversal and possibly other impact. Resolution ========== Upgrade to 7.2p2-1. # pacman -Syu "openssh>=7.2p2-1" The problem has been fixed upstream in version 7.2p2. Workaround ========== Set X11Forwarding=no in sshd_config. This is the default. For authorized_keys that specify a "command" restriction, also set the "restrict" or "no-x11-forwarding" restrictions. Description =========== Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege. Other xauth commands allow limited information leakage, file overwrite, port probing and generally expose xauth, which was not written with a hostile user in mind, as an attack surface. xauth is run under the user's privilege, so this vulnerability offers no additional access to unrestricted accounts, but could circumvent key or account restrictions such as sshd_config ForceCommand, authorized_keys command="..." or restricted shells. Impact ====== A remote authenticated user who is able to request X11 forwarding can inject commands to xauth leading to information disclosure, directory traversal and possibly other impact. References ========== http://www.openssh.com/txt/x11fwd.adv https://access.redhat.com/security/cve/CVE-2016-3115

1 0

[arch-security] [ASA-201603-11] lib32-flashplugin: arbitrary code execution
by Christian Rebischke 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-11 ========================================== Severity: Critical Date : 2016-03-11 CVE-ID : CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.577-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.577-1. # pacman -Syu "lib32-flashplugin>=11.2.202.577-1" The problem has been fixed upstream in version 11.2.202.577. Workaround ========== None. Description =========== - CVE-2016-0963 CVE-2016-0993 CVE-2016-1010 (arbitrary code execution) Integer overflow vulnerabilities that could lead to code execution. - CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 (arbitrary code execution) Use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1001 (arbitrary code execution) Heap overflow vulnerability that could lead to code execution. - CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0986 CVE-2016-0989 CVE-2016-0992 CVE-2016-1002 CVE-2016-1005 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-0960 https://access.redhat.com/security/cve/CVE-2016-0961 https://access.redhat.com/security/cve/CVE-2016-0962 https://access.redhat.com/security/cve/CVE-2016-0963 https://access.redhat.com/security/cve/CVE-2016-0986 https://access.redhat.com/security/cve/CVE-2016-0987 https://access.redhat.com/security/cve/CVE-2016-0988 https://access.redhat.com/security/cve/CVE-2016-0989 https://access.redhat.com/security/cve/CVE-2016-0990 https://access.redhat.com/security/cve/CVE-2016-0991 https://access.redhat.com/security/cve/CVE-2016-0992 https://access.redhat.com/security/cve/CVE-2016-0993 https://access.redhat.com/security/cve/CVE-2016-0994 https://access.redhat.com/security/cve/CVE-2016-0995 https://access.redhat.com/security/cve/CVE-2016-0996 https://access.redhat.com/security/cve/CVE-2016-0997 https://access.redhat.com/security/cve/CVE-2016-0998 https://access.redhat.com/security/cve/CVE-2016-0999 https://access.redhat.com/security/cve/CVE-2016-1000 https://access.redhat.com/security/cve/CVE-2016-1001 https://access.redhat.com/security/cve/CVE-2016-1002 https://access.redhat.com/security/cve/CVE-2016-1005 https://access.redhat.com/security/cve/CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

1 0

[arch-security] [ASA-201603-10] flashplugin: arbitrary code execution
by Christian Rebischke 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-10 ========================================== Severity: Critical Date : 2016-03-11 CVE-ID : CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Package : flashplugin Type : abitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.577-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 11.2.202.577-1. # pacman -Syu "flashplugin>=11.2.202.577-1" The problems have been fixed upstream in version 11.2.202.577. Workaround ========== None. Description =========== - CVE-2016-0963 CVE-2016-0993 CVE-2016-1010 (arbitrary code execution) Integer overflow vulnerabilities that could lead to code execution. - CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 (abitrary code execution) Use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1001 (abitrary code execution) Heap overflow vulnerability that could lead to code execution. - CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0986 CVE-2016-0989 CVE-2016-0992 CVE-2016-1002 CVE-2016-1005 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-0960 https://access.redhat.com/security/cve/CVE-2016-0961 https://access.redhat.com/security/cve/CVE-2016-0962 https://access.redhat.com/security/cve/CVE-2016-0963 https://access.redhat.com/security/cve/CVE-2016-0986 https://access.redhat.com/security/cve/CVE-2016-0987 https://access.redhat.com/security/cve/CVE-2016-0988 https://access.redhat.com/security/cve/CVE-2016-0989 https://access.redhat.com/security/cve/CVE-2016-0990 https://access.redhat.com/security/cve/CVE-2016-0991 https://access.redhat.com/security/cve/CVE-2016-0992 https://access.redhat.com/security/cve/CVE-2016-0993 https://access.redhat.com/security/cve/CVE-2016-0994 https://access.redhat.com/security/cve/CVE-2016-0995 https://access.redhat.com/security/cve/CVE-2016-0996 https://access.redhat.com/security/cve/CVE-2016-0997 https://access.redhat.com/security/cve/CVE-2016-0998 https://access.redhat.com/security/cve/CVE-2016-0999 https://access.redhat.com/security/cve/CVE-2016-1000 https://access.redhat.com/security/cve/CVE-2016-1001 https://access.redhat.com/security/cve/CVE-2016-1002 https://access.redhat.com/security/cve/CVE-2016-1005 https://access.redhat.com/security/cve/CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

1 0

[arch-security] [ASA-201603-9] perl: improper input validation
by Levente Polyak 10 Mar '16

10 Mar '16

Arch Linux Security Advisory ASA-201603-9 ========================================= Severity: Medium Date : 2016-03-10 CVE-ID : CVE-2016-2381 Package : perl Type : improper input validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package perl before version 5.22.1-2 is vulnerable to improper input validation leading to malicious environment variable propagation. Resolution ========== Upgrade to 5.22.1-2. # pacman -Syu "perl>=5.22.1-2" The problem has been fixed upstream in version 5.22.1. Workaround ========== None. Description =========== Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking. Impact ====== A remote attacker is able to bypass the taint checking and propagate malicious environment variables to subprocesses. References ========== https://access.redhat.com/security/cve/CVE-2016-2381 https://bugs.archlinux.org/task/48482 http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a

1 0

[arch-security] [ASA-201603-8] exim: privilege escalation
by Levente Polyak 10 Mar '16

10 Mar '16

Arch Linux Security Advisory ASA-201603-8 ========================================= Severity: High Date : 2016-03-10 CVE-ID : CVE-2016-1531 Package : exim Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package exim before version 4.86.2-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.86.2-2. # pacman -Syu "exim>=4.86.2-2" The problem has been fixed upstream in version 4.86.2. Workaround ========== None. Description =========== All installations having Exim set-uid root and using 'perl_startup' are vulnerable to a local privilege escalation. Any user who can start an instance of Exim (and this is normally *any* user) can gain root privileges. Impact ====== A local attacker is able to use a privilege escalation vulnerability to gain root privileges. References ========== http://www.exim.org/static/doc/CVE-2016-1531.txt https://access.redhat.com/security/cve/CVE-2016-1531

1 0

[arch-security] [ASA-201603-7] bind: denial of service
by Remi Gacogne 09 Mar '16

09 Mar '16

Arch Linux Security Advisory ASA-201603-7 ========================================= Severity: High Date : 2016-03-09 CVE-ID : CVE-2016-1285 CVE-2016-1286 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P4-1. # pacman -Syu "bind>=9.10.3.P4-1" The problem has been fixed upstream in version 9.9.8-P4 and 9.10.3.P4. Workaround ========== - CVE-2016-1285: Restrict access to the control channel (by using the "controls" configuration statement in named.conf) to allow connection only from trusted systems. Note that if no "controls" statement is present, named defaults to allowing control channel connections only from localhost (127.0.0.1 and ::1) if and only if the file rndc.key exists in the configuration directory and contains valid key syntax. If rndc.key is not present and no "controls" statement is present in named.conf, named will not accept commands on the control channel. - CVE-2016-1286: None. Description =========== - CVE-2016-1285: Testing by ISC has uncovered a defect in control channel input handling which can cause named to exit due to an assertion failure in sexpr.c or alist.c when a malformed packet is sent to named's control channel (the interface which allows named to be controlled using the 'rndc" server control utility). This assertion occurs before authentication but after network-address-based access controls have been applied. Or in other words: an attacker does not need to have a key or other authentication, but does need to be within the address list specified in the "controls" statement in named.conf which enables the control channel. If no "controls" statement is present in named.conf, named still defaults to listening for control channel information on loopback addresses (127.0.0.1 and ::1) if the file rndc.key is present in the configuration directory and contains a valid key. A search for similar problems revealed an associated defect in the rndc server control utility whereby a malformed response from the server could cause the rndc program to crash. For completeness, it is being fixed at the same time even though this defect in the rndc utility is not in itself exploitable. - CVE-2016-1286: An error when parsing signature records for DNAME records having specific properties can lead to named exiting due to an assertion failure in resolver.c or db.c. Impact ====== A remote attacker can crash a vulnerable bind server, authoritative or recursive, by sending a crafted response to a query or, if allowed by the network-address-based ACLs, by sending a crafted packet to the control channel. References ========== https://kb.isc.org/article/AA-01352/ https://kb.isc.org/article/AA-01353/ https://access.redhat.com/security/cve/CVE-2016-1285 https://access.redhat.com/security/cve/CVE-2016-1286

1 0

[arch-security] [ASA-201603-6] libotr: arbitrary code execution
by Christian Rebischke 09 Mar '16

09 Mar '16

Arch Linux Security Advisory ASA-201603-6 ========================================= Severity: High Date : 2016-03-09 CVE-ID : CVE-2016-2851 Package : libotr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libotr before version 4.1.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.1.1-1. # pacman -Syu "libotr>=4.1.1-1" The problems has been fixed upstream in version 4.1.1. Workaround ========== None. Description =========== - CVE-2016-2851 (arbitrary code execution) Versions 4.1.0 and earlier of libotr in 64-bit builds contain an integer overflow security flaw. This flaw could potentially be exploited by a remote attacker to cause a heap buffer overflow and subsequently for arbitrary code to be executed on the user's machine. Impact ====== A remote attacker is able to create a payload that is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-2851 https://otr.cypherpunks.ca/

1 0

[arch-security] [ASA-201603-5] chromium: multiple issues
by Christian Rebischke 09 Mar '16

09 Mar '16

Arch Linux Security Advisory ASA-201603-5 ========================================= Severity: High Date : 2016-03-09 CVE-ID : CVE-2016-1643 CVE-2016-1644 CVE-2016-1645 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 49.0.2623.87-1 is vulnerable to multiple issues including type confusion, use-after-free and out-of-bounds write. Resolution ========== Upgrade to 49.0.2623.87-1. # pacman -Syu "chromium>=49.0.2623.87-1" The problems have been fixed upstream in version 49.0.2623.87. Workaround ========== None. Description =========== - CVE-2016-1643 (type confusion) Type confusion in Blink. - CVE-2016-1644 (use-after-free) Use-after-free in Blink. - CVE-2016-1645 (out-of-bounds write) Out-of-bounds write in PDFium. Impact ====== A remote attacker is able to crash the application resulting in denial of service or execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2016-1643 https://access.redhat.com/security/cve/CVE-2016-1644 https://access.redhat.com/security/cve/CVE-2016-1645 http://googlechromereleases.blogspot.de/2016/03/stable-channel-update_8.html

1 0

[arch-security] [ASA-201603-4] firefox: multiple issues
by Levente Polyak 09 Mar '16

09 Mar '16

Arch Linux Security Advisory ASA-201603-4 ========================================= Severity: Critical Date : 2016-03-09 CVE-ID : CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1955 CVE-2016-1956 CVE-2016-1957 CVE-2016-1958 CVE-2016-1959 CVE-2016-1960 CVE-2016-1961 CVE-2016-1962 CVE-2016-1963 CVE-2016-1964 CVE-2016-1965 CVE-2016-1966 CVE-2016-1967 CVE-2016-1968 CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1973 CVE-2016-1974 CVE-2016-1975 CVE-2016-1976 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 45.0-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, same-origin bypass, adressbar spoofing, information disclosure, denial of service and privilege escalation. Resolution ========== Upgrade to 45.0-1. # pacman -Syu "firefox>=45.0-1" The problems have been fixed upstream in version 45.0. Workaround ========== None. Description =========== - CVE-2016-1952 CVE-2016-1953 (arbitrary code execution) Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-1954 (privilege escalation) Security researcher Nicolas Golubovic reported that a malicious page can overwrite files on the user's machine using Content Security Policy (CSP) violation reports. The file contents are restricted to the JSON format of the report. In many cases overwriting a local file may simply be destructive, breaking the functionality of that file. The CSP error reports can include HTML fragments which could be rendered by browsers. If a user has disabled add-on signing and has installed an "unpacked" add-on, a malicious page could overwrite one of the add-on resources. Depending on how this resource is used, this could lead to privilege escalation. - CVE-2016-1955 (information disclosure) Security researcher Muneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. reported that Content Security Policy (CSP) violation reports contained full path information for cross-origin iframe navigations in violation of the CSP specification. This could result in information disclosure. - CVE-2016-1956 (denial of service) Security researcher Ucha Gobejishvili reported a denial of service (DOS) attack when doing certain WebGL operations in a canvas requiring an unusually large amount buffer to be allocated from video memory. This resulted in memory resource exhaustion with some Intel video cards, requiring the computer to be rebooted to return functionality. This was resolved by putting in additional checks on the amount of memory to be allocated during graphics processing. - CVE-2016-1957 (resource consumption) Security researchers Jose Martinez and Romina Santillan reported a memory leak in the libstagefright library when array destruction occurs during MPEG4 video file processing. - CVE-2016-1958 (addressbar spoofing) Security researcher Abdulrahman Alqabandi reported an issue where an attacker can load an arbitrary web page but the addressbar's displayed URL will be blank or filled with page defined content. This can be used to obfuscate which page is currently loaded and allows for an attacker to spoof an existing page without the malicious page's address being displayed correctly. - CVE-2016-1959 (denial of service) Security researcher Looben Yang reported a mechanism where the Clients API in Service Workers can be used to trigger an out-of-bounds read in ServiceWorkerManager. This results in a potentially exploitable crash. - CVE-2016-1960 (arbitrary code execution) Security researcher ca0nguyen, working with HP's Zero Day Initiative, reported a use-after-free issue in the HTML5 string parser when parsing a particular set of table-related tags in a foreign fragment context such as SVG. This results in a potentially exploitable crash. - CVE-2016-1961 (arbitrary code execution) Security researcher lokihardt, working with HP's Zero Day Initiative, reported a use-after-free issue in the SetBody function of HTMLDocument. This results in a potentially exploitable crash. - CVE-2016-1962 (arbitrary code execution) Security researcher Dominique Hazaël-Massieux reported a use-after-free issue when using multiple WebRTC data channel connections. This causes a potentially exploitable crash when a data channel connection is freed from within a call through it. - CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 (buffer overflow) Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. - CVE-2016-1963 (denial of service) Security researcher Oriol reported memory corruption when local files are modified (by either the user or another program) at the same time being read using the FileReader API. This flaw requires that input be taken from a local file in order to be triggered and cannot be triggered by web content. This results in a potentially exploitable crash when triggered. - CVE-2016-1964 (arbitrary code execution) Security researcher Nicolas Grégoire used the Address Sanitizer to find a use-after-free during XML transformation operations. This results in a potentially exploitable crash triggerable by web content. - CVE-2016-1965 (addressbar spoofing) Security researcher Tsubasa Iinuma reported a mechanism where the displayed addressbar can be spoofed to users. This issue involves using history navigation in concert with the Location protocol property. After navigating from a malicious page to another, if the user navigates back to the initial page, the displayed URL will not reflect the reloaded page. This could be used to trick users into potentially treating the page as a different and trusted site. - CVE-2016-1966 (remote code execution) The Communications Electronics Security Group (UK) of the GCHQ reported a dangling pointer dereference within the Netscape Plugin Application Programming Interface (NPAPI) that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted NPAPI plugin in concert with scripted web content, resulting in a potentially exploitable crash when triggered. - CVE-2016-1967 (same-origin policy bypass) Security researcher Jordi Chancel discovered a variant of Mozilla Foundation Security Advisory 2015-136 which was fixed in Firefox 43. In the original bug, it was possible to read cross-origin URLs following a redirect if performance.getEntries() was used along with an iframe to host a page. Navigating back in history through script, content was pulled from the browser cache for the redirected location instead of going to the original location. In the newly reported variant issue, it was found that if a browser session was restored, history navigation would still allow for the same attack as content was restored from the browser cache. This is a same-origin policy violation and could allow for data theft. - CVE-2016-1968 (remote code execution) Security researcher Luke Li reported a pointer underflow bug in the Brotli library's decompression that leads to a buffer overflow. This results in a potentially exploitable crash when triggered. - CVE-2016-1970 CVE-2016-1971 CVE-2016-1972 CVE-2016-1975 CVE-2016-197 (denial of service) Security researcher Ronald Crane reported five "moderate" rated vulnerabilities affecting released code that were found through code inspection. These included the following issues in WebRTC: an integer underflow, a missing status check, race condition, and a use of deleted pointers to create new object. A race condition in LibVPX was also identified. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. - CVE-2016-1973 (use-after-free) Security researcher Ronald Crane reported a race condition in GetStaticInstance in WebRTC which results in a use-after-free. This could result in a potentially exploitable crash. This issue was found through code inspection and does not have clear mechanism to be exploited through web content but is vulnerable if a mechanism can be found to trigger it. - CVE-2016-1974 (denial of service) Security researcher Ronald Crane reported an out-of-bounds read following a failed allocation in the HTML parser while working with unicode strings. This can also affect the parsing of XML and SVG format data. This leads to a potentially exploitable crash. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same-origin policy, spoof the adressbar, disclose sensitive information, perform a denial of service attack and escalation privileges via various vulnerabilities. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://access.redhat.com/security/cve/CVE-2016-1952 https://access.redhat.com/security/cve/CVE-2016-1953 https://access.redhat.com/security/cve/CVE-2016-1954 https://access.redhat.com/security/cve/CVE-2016-1955 https://access.redhat.com/security/cve/CVE-2016-1956 https://access.redhat.com/security/cve/CVE-2016-1957 https://access.redhat.com/security/cve/CVE-2016-1958 https://access.redhat.com/security/cve/CVE-2016-1959 https://access.redhat.com/security/cve/CVE-2016-1960 https://access.redhat.com/security/cve/CVE-2016-1961 https://access.redhat.com/security/cve/CVE-2016-1962 https://access.redhat.com/security/cve/CVE-2016-1963 https://access.redhat.com/security/cve/CVE-2016-1964 https://access.redhat.com/security/cve/CVE-2016-1965 https://access.redhat.com/security/cve/CVE-2016-1966 https://access.redhat.com/security/cve/CVE-2016-1967 https://access.redhat.com/security/cve/CVE-2016-1968 https://access.redhat.com/security/cve/CVE-2016-1970 https://access.redhat.com/security/cve/CVE-2016-1971 https://access.redhat.com/security/cve/CVE-2016-1972 https://access.redhat.com/security/cve/CVE-2016-1973 https://access.redhat.com/security/cve/CVE-2016-1974 https://access.redhat.com/security/cve/CVE-2016-1975 https://access.redhat.com/security/cve/CVE-2016-1976 https://access.redhat.com/security/cve/CVE-2016-1977 https://access.redhat.com/security/cve/CVE-2016-2790 https://access.redhat.com/security/cve/CVE-2016-2791 https://access.redhat.com/security/cve/CVE-2016-2792 https://access.redhat.com/security/cve/CVE-2016-2793 https://access.redhat.com/security/cve/CVE-2016-2794 https://access.redhat.com/security/cve/CVE-2016-2795 https://access.redhat.com/security/cve/CVE-2016-2796 https://access.redhat.com/security/cve/CVE-2016-2797 https://access.redhat.com/security/cve/CVE-2016-2798 https://access.redhat.com/security/cve/CVE-2016-2799 https://access.redhat.com/security/cve/CVE-2016-2800 https://access.redhat.com/security/cve/CVE-2016-2801 https://access.redhat.com/security/cve/CVE-2016-2802

1 0

[arch-security] [ASA-201603-3] lib32-openssl: multiple issues
by Levente Polyak 07 Mar '16

07 Mar '16

Arch Linux Security Advisory ASA-201603-3 ========================================= Severity: High Date : 2016-03-07 CVE-ID : CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1:1.0.2.g-3 is vulnerable to multiple issues including but not limited to private key extraction, denial of service, arbitrary code execution, resource consumption and cross-protocol attacks leading to cipher text decryption. Resolution ========== Upgrade to 1:1.0.2.g-3. # pacman -Syu "lib32-openssl>=1:1.0.2.g-3" The problems have been fixed upstream in version 1:1.0.2.g-3. Workaround ========== None. Description =========== - CVE-2016-0702 (private key extraction) A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing decryption, could use this flaw to recover RSA private keys. - CVE-2016-0705 (denial of service) A double-free flaw was found in the way OpenSSL parsed certain malformed DSA (Digital Signature Algorithm) private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash. - CVE-2016-0797 (arbitrary code execution) An integer overflow flaw, leading to a NULL pointer dereference or a heap-based memory corruption, was found in the way some BIGNUM functions of OpenSSL were implemented. Applications that use these functions with large untrusted input could crash or, potentially, execute arbitrary code. - CVE-2016-0798 (resource consumption) A memory leak flaw was found in the way OpenSSL performed SRP user database look-ups using the SRP_VBASE_get_by_user() function. A remote attacker connecting to certain SRP servers with an invalid user name could leak approximately 300 bytes of the server's memory per connection. - CVE-2016-0799 (denial of service) The fmtstr function in crypto/bio/b_print.c improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. - CVE-2016-0800 (cross-protocol attack) A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN. Impact ====== A remote attacker is able to use multiple issues to perform a denial of service attack, trigger a memory leak resulting in resource consumption, use a cross-protocol attack that is leading to cipher text decryption or possibly execute arbitrary code under certain circumstances. Furthermore a local attacker may be able to extract the RSA private key by running code in a thread that is running on the same hyper-threaded core as the victim's thread that is performing decryption. References ========== https://www.openssl.org/news/secadv/20160301.txt https://access.redhat.com/security/cve/CVE-2016-0702 https://access.redhat.com/security/cve/CVE-2016-0705 https://access.redhat.com/security/cve/CVE-2016-0797 https://access.redhat.com/security/cve/CVE-2016-0798 https://access.redhat.com/security/cve/CVE-2016-0799 https://access.redhat.com/security/cve/CVE-2016-0800

1 0

[arch-security] [ASA-201603-2] openssl: multiple issues
by Levente Polyak 07 Mar '16

07 Mar '16

Arch Linux Security Advisory ASA-201603-2 ========================================= Severity: High Date : 2016-03-07 CVE-ID : CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 Package : openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.g-3 is vulnerable to multiple issues including but not limited to private key extraction, denial of service, arbitrary code execution, resource consumption and cross-protocol attacks leading to cipher text decryption. Resolution ========== Upgrade to 1.0.2.g-3. # pacman -Syu "openssl>=1.0.2.g-3" The problems have been fixed upstream in version 1.0.2.g-3. Workaround ========== None. Description =========== - CVE-2016-0702 (private key extraction) A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing decryption, could use this flaw to recover RSA private keys. - CVE-2016-0705 (denial of service) A double-free flaw was found in the way OpenSSL parsed certain malformed DSA (Digital Signature Algorithm) private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash. - CVE-2016-0797 (arbitrary code execution) An integer overflow flaw, leading to a NULL pointer dereference or a heap-based memory corruption, was found in the way some BIGNUM functions of OpenSSL were implemented. Applications that use these functions with large untrusted input could crash or, potentially, execute arbitrary code. - CVE-2016-0798 (resource consumption) A memory leak flaw was found in the way OpenSSL performed SRP user database look-ups using the SRP_VBASE_get_by_user() function. A remote attacker connecting to certain SRP servers with an invalid user name could leak approximately 300 bytes of the server's memory per connection. - CVE-2016-0799 (denial of service) The fmtstr function in crypto/bio/b_print.c improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. - CVE-2016-0800 (cross-protocol attack) A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN. Impact ====== A remote attacker is able to use multiple issues to perform a denial of service attack, trigger a memory leak resulting in resource consumption, use a cross-protocol attack that is leading to cipher text decryption or possibly execute arbitrary code under certain circumstances. Furthermore a local attacker may be able to extract the RSA private key by running code in a thread that is running on the same hyper-threaded core as the victim's thread that is performing decryption. References ========== https://www.openssl.org/news/secadv/20160301.txt https://access.redhat.com/security/cve/CVE-2016-0702 https://access.redhat.com/security/cve/CVE-2016-0705 https://access.redhat.com/security/cve/CVE-2016-0797 https://access.redhat.com/security/cve/CVE-2016-0798 https://access.redhat.com/security/cve/CVE-2016-0799 https://access.redhat.com/security/cve/CVE-2016-0800

1 0

[arch-security] [ASA-201603-1] chromium: multiple issues
by Remi Gacogne 03 Mar '16

03 Mar '16

Arch Linux Security Advisory ASA-201603-1 ========================================= Severity: High Date : 2016-03-03 CVE-ID : CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 49.0.2623.75-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 49.0.2623.75-1. # pacman -Syu "chromium>=49.0.2623.75-1" The problem has been fixed upstream in version 49.0.2623.75. Workaround ========== None. Description =========== - CVE-2015-8126: Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. - CVE-2016-1630: Same-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1631: Same-origin bypass in Pepper Plugin. Credit to Mariusz Mlynski. - CVE-2016-1632: Bad cast in Extensions. - CVE-2016-1633, CVE-2016-1634: Use-after-free in Blink. Credit to cloudfuzzer. - CVE-2016-1635: Use-after-free in Blink. Credit to Rob Wu. - CVE-2016-1636: SRI Validation Bypass. Credit to Ryan Lester and Bryant Zadegan. - CVE-2016-1637: Information Leak in Skia. Credit to Keve Nagy. - CVE-2016-1638: WebAPI Bypass. Credit to Rob Wu. - CVE-2016-1639: Use-after-free in WebRTC. Credit to Khalil Zhani. - CVE-2016-1640: Origin confusion in Extensions UI. Credit to Luan Herrera. - CVE-2016-1641: Use-after-free in Favicon. Credit to Atte Kettunen of OUSPG. - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass restrictions like the same-origin policy and the WebAPI restrictions, or have other unspecified impact. References ========== http://googlechromereleases.blogspot.fr/2016/03/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-8126 https://access.redhat.com/security/cve/CVE-2016-1630 https://access.redhat.com/security/cve/CVE-2016-1631 https://access.redhat.com/security/cve/CVE-2016-1632 https://access.redhat.com/security/cve/CVE-2016-1633 https://access.redhat.com/security/cve/CVE-2016-1634 https://access.redhat.com/security/cve/CVE-2016-1635 https://access.redhat.com/security/cve/CVE-2016-1636 https://access.redhat.com/security/cve/CVE-2016-1637 https://access.redhat.com/security/cve/CVE-2016-1638 https://access.redhat.com/security/cve/CVE-2016-1639 https://access.redhat.com/security/cve/CVE-2016-1640 https://access.redhat.com/security/cve/CVE-2016-1641 https://access.redhat.com/security/cve/CVE-2016-1642

1 0