March 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201603-17] wireshark-gtk: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-17 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-gtk before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-gtk>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-16] wireshark-qt: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-16 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-qt>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-15] wireshark-cli: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-15 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-cli>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing a vulnerable user to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-14] pidgin-otr: arbitrary code execution
by Levente Polyak 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-14 ========================================== Severity: High Date : 2016-03-12 CVE-ID : CVE-2015-8833 Package : pidgin-otr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pidgin-otr before version 4.0.2-1 is vulnerable to use-after-free leading to denial of service or possible arbitrary code execution. Resolution ========== Upgrade to 4.0.2-1. # pacman -Syu "pidgin-otr>=4.0.2-1" The problem has been fixed upstream in version 4.0.2. Workaround ========== None. Description =========== The pidgin-otr plugin fixes a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function create_smp_dialog. This issue is leading to denial of service or possibly remote code execution. Impact ====== A remote attacker is able to trigger a user-after-free during otr authentication and possibly execute arbitrary code References ========== https://access.redhat.com/security/cve/CVE-2015-8833 http://seclists.org/oss-sec/2016/q1/572 https://bugs.otr.im/issues/88 https://bugs.archlinux.org/task/48537

1 0

[arch-security] [ASA-201603-13] bind: denial of service
by Christian Rebischke 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-13 ========================================== Severity: Low Date : 2016-03-12 CVE-ID : CVE-2016-2088 CVE-2016-1286 CVE-2016-1285 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P4-1 . # pacman -Syu "bind>=9.10.3.P4-1" The problem has been fixed upstream in version 9.10.3-P4. Workaround ========== None. Description =========== - CVE-2016-2088 (denial of service) Allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option. - CVE-2016-1286 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. - CVE-2016-1285 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c Impact ====== A remote attacker is able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2088 https://access.redhat.com/security/cve/CVE-2016-1286 https://access.redhat.com/security/cve/CVE-2016-1285 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2088 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1286 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1285

1 0

[arch-security] [ASA-201603-12] openssh: command injection
by Levente Polyak 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-12 ========================================== Severity: Medium Date : 2016-03-11 CVE-ID : CVE-2016-3115 Package : openssh Type : command injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 7.2p2-1 is vulnerable to command injection leading to information disclosure, directory traversal and possibly other impact. Resolution ========== Upgrade to 7.2p2-1. # pacman -Syu "openssh>=7.2p2-1" The problem has been fixed upstream in version 7.2p2. Workaround ========== Set X11Forwarding=no in sshd_config. This is the default. For authorized_keys that specify a "command" restriction, also set the "restrict" or "no-x11-forwarding" restrictions. Description =========== Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege. Other xauth commands allow limited information leakage, file overwrite, port probing and generally expose xauth, which was not written with a hostile user in mind, as an attack surface. xauth is run under the user's privilege, so this vulnerability offers no additional access to unrestricted accounts, but could circumvent key or account restrictions such as sshd_config ForceCommand, authorized_keys command="..." or restricted shells. Impact ====== A remote authenticated user who is able to request X11 forwarding can inject commands to xauth leading to information disclosure, directory traversal and possibly other impact. References ========== http://www.openssh.com/txt/x11fwd.adv https://access.redhat.com/security/cve/CVE-2016-3115

1 0

[arch-security] [ASA-201603-11] lib32-flashplugin: arbitrary code execution
by Christian Rebischke 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-11 ========================================== Severity: Critical Date : 2016-03-11 CVE-ID : CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.577-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.577-1. # pacman -Syu "lib32-flashplugin>=11.2.202.577-1" The problem has been fixed upstream in version 11.2.202.577. Workaround ========== None. Description =========== - CVE-2016-0963 CVE-2016-0993 CVE-2016-1010 (arbitrary code execution) Integer overflow vulnerabilities that could lead to code execution. - CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 (arbitrary code execution) Use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1001 (arbitrary code execution) Heap overflow vulnerability that could lead to code execution. - CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0986 CVE-2016-0989 CVE-2016-0992 CVE-2016-1002 CVE-2016-1005 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-0960 https://access.redhat.com/security/cve/CVE-2016-0961 https://access.redhat.com/security/cve/CVE-2016-0962 https://access.redhat.com/security/cve/CVE-2016-0963 https://access.redhat.com/security/cve/CVE-2016-0986 https://access.redhat.com/security/cve/CVE-2016-0987 https://access.redhat.com/security/cve/CVE-2016-0988 https://access.redhat.com/security/cve/CVE-2016-0989 https://access.redhat.com/security/cve/CVE-2016-0990 https://access.redhat.com/security/cve/CVE-2016-0991 https://access.redhat.com/security/cve/CVE-2016-0992 https://access.redhat.com/security/cve/CVE-2016-0993 https://access.redhat.com/security/cve/CVE-2016-0994 https://access.redhat.com/security/cve/CVE-2016-0995 https://access.redhat.com/security/cve/CVE-2016-0996 https://access.redhat.com/security/cve/CVE-2016-0997 https://access.redhat.com/security/cve/CVE-2016-0998 https://access.redhat.com/security/cve/CVE-2016-0999 https://access.redhat.com/security/cve/CVE-2016-1000 https://access.redhat.com/security/cve/CVE-2016-1001 https://access.redhat.com/security/cve/CVE-2016-1002 https://access.redhat.com/security/cve/CVE-2016-1005 https://access.redhat.com/security/cve/CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

1 0

[arch-security] [ASA-201603-10] flashplugin: arbitrary code execution
by Christian Rebischke 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-10 ========================================== Severity: Critical Date : 2016-03-11 CVE-ID : CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Package : flashplugin Type : abitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.577-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 11.2.202.577-1. # pacman -Syu "flashplugin>=11.2.202.577-1" The problems have been fixed upstream in version 11.2.202.577. Workaround ========== None. Description =========== - CVE-2016-0963 CVE-2016-0993 CVE-2016-1010 (arbitrary code execution) Integer overflow vulnerabilities that could lead to code execution. - CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 (abitrary code execution) Use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1001 (abitrary code execution) Heap overflow vulnerability that could lead to code execution. - CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0986 CVE-2016-0989 CVE-2016-0992 CVE-2016-1002 CVE-2016-1005 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-0960 https://access.redhat.com/security/cve/CVE-2016-0961 https://access.redhat.com/security/cve/CVE-2016-0962 https://access.redhat.com/security/cve/CVE-2016-0963 https://access.redhat.com/security/cve/CVE-2016-0986 https://access.redhat.com/security/cve/CVE-2016-0987 https://access.redhat.com/security/cve/CVE-2016-0988 https://access.redhat.com/security/cve/CVE-2016-0989 https://access.redhat.com/security/cve/CVE-2016-0990 https://access.redhat.com/security/cve/CVE-2016-0991 https://access.redhat.com/security/cve/CVE-2016-0992 https://access.redhat.com/security/cve/CVE-2016-0993 https://access.redhat.com/security/cve/CVE-2016-0994 https://access.redhat.com/security/cve/CVE-2016-0995 https://access.redhat.com/security/cve/CVE-2016-0996 https://access.redhat.com/security/cve/CVE-2016-0997 https://access.redhat.com/security/cve/CVE-2016-0998 https://access.redhat.com/security/cve/CVE-2016-0999 https://access.redhat.com/security/cve/CVE-2016-1000 https://access.redhat.com/security/cve/CVE-2016-1001 https://access.redhat.com/security/cve/CVE-2016-1002 https://access.redhat.com/security/cve/CVE-2016-1005 https://access.redhat.com/security/cve/CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

1 0

[arch-security] [ASA-201603-9] perl: improper input validation
by Levente Polyak 10 Mar '16

10 Mar '16

Arch Linux Security Advisory ASA-201603-9 ========================================= Severity: Medium Date : 2016-03-10 CVE-ID : CVE-2016-2381 Package : perl Type : improper input validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package perl before version 5.22.1-2 is vulnerable to improper input validation leading to malicious environment variable propagation. Resolution ========== Upgrade to 5.22.1-2. # pacman -Syu "perl>=5.22.1-2" The problem has been fixed upstream in version 5.22.1. Workaround ========== None. Description =========== Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking. Impact ====== A remote attacker is able to bypass the taint checking and propagate malicious environment variables to subprocesses. References ========== https://access.redhat.com/security/cve/CVE-2016-2381 https://bugs.archlinux.org/task/48482 http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a

1 0

[arch-security] [ASA-201603-8] exim: privilege escalation
by Levente Polyak 10 Mar '16

10 Mar '16

Arch Linux Security Advisory ASA-201603-8 ========================================= Severity: High Date : 2016-03-10 CVE-ID : CVE-2016-1531 Package : exim Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package exim before version 4.86.2-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.86.2-2. # pacman -Syu "exim>=4.86.2-2" The problem has been fixed upstream in version 4.86.2. Workaround ========== None. Description =========== All installations having Exim set-uid root and using 'perl_startup' are vulnerable to a local privilege escalation. Any user who can start an instance of Exim (and this is normally *any* user) can gain root privileges. Impact ====== A local attacker is able to use a privilege escalation vulnerability to gain root privileges. References ========== http://www.exim.org/static/doc/CVE-2016-1531.txt https://access.redhat.com/security/cve/CVE-2016-1531

1 0