April 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201604-15] firefox: multiple issues
by Remi Gacogne 30 Apr '16

30 Apr '16

Arch Linux Security Advisory ASA-201604-15 ========================================== Severity: Critical Date : 2016-04-30 CVE-ID : CVE-2016-2804 CVE-2016-2805 CVE-2016-2806 CVE-2016-2807 CVE-2016-2808 CVE-2016-2811 CVE-2016-2812 CVE-2016-2814 CVE-2016-2816 CVE-2016-2817 CVE-2016-2820 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 46.0-2 is vulnerable to multiple issues, up to arbitrary code execution. Resolution ========== Upgrade to 46.0-2. # pacman -Syu "firefox>=46.0-2" The problem has been fixed upstream in version 46.0. Workaround ========== None. Description =========== - CVE-2016-2804: Gary Kwong, Christian Holler, Andrew McCreight, Boris Zbarsky, and Steve Fink reported memory safety problems and crashes that are fixed in Firefox 46. - CVE-2016-2805: Christian Holler reported a memory safety problem that is fixed in Firefox ESR 38.8. - CVE-2016-2806: Gary Kwong, Christian Holler, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, and Randell Jesup reported memory safety problems and crashes that are fixed in Firefox ESR 45.1 and Firefox 46. - CVE-2016-2807: Christian Holler, Tyson Smith, and Phil Ringalda reported memory safety problems and crashes that are fixed in Firefox ESR 45.1, Firefox ESR 38.8 and Firefox 46. - CVE-2016-2808: The CESG, the Information Security Arm of GCHQ, reported that the JavaScript .watch() method could be used to overflow the 32-bit generation count of the underlying HashMap, resulting in a write to an invalid entry. Under the right conditions this write could lead to arbitrary code execution. The overflow takes considerable time and a malicious page would require a user to keep it open for the duration of the attack. - CVE-2016-2811, CVE-2016-2812: Security researcher Looben Yang reported two issues discovered in Service Workers using Address Sanitizer. The first of these is a use-after-free vulnerability caused by a ServiceWorkerInfo object being kept active beyond the life its owning registration. When it is later called through this registration, a use-after-free results. In the second issue, a race condition leading to a buffer overflow was found in the ServiceWorkerManager. This leads to a potentially exploitable crash when triggered. - CVE-2016-2814: Using Address Sanitizer, security researcher Sascha Just reported a buffer overflow in the libstagefright library due to issues with the handling of CENC offsets and the sizes table. This results in a potentially exploitable crash triggerable through web content. - CVE-2016-2816: Security researcher Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd. reported that Content Security Policy (CSP) is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. This allows for script to run in instances where CSP should block it, leading to a failure to prevent potential cross-site scripting (XSS) and other attacks against the web page. - CVE-2016-2817: Security researcher Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd. reported that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs without additional permissions. This can used to elevate privilege for a universal cross-site scripting (XSS) attack by a malicious web extension. It can also be used to inject content into other extensions if they load content within browser tabs. - CVE-2016-2820: Mozilla engineer Mark Goodwin discovered that the Firefox Health Report (about:healthreport) accepts certain events from any content document present in the remote-report iframe. If there were another vulnerability that allowed the injection of web content into the Firefox Health Report iframe, this content could change the sharing preferences of a user by firing the appropriate events at it s containing page. Impact ====== A remote attacker can bypass security policies, cause a denial of service or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://www.mozilla.org/en-US/security/advisories/mfsa2016-39/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-42/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-44/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-45/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-46/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-47/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-48/ https://access.redhat.com/security/cve/CVE-2016-2804 https://access.redhat.com/security/cve/CVE-2016-2805 https://access.redhat.com/security/cve/CVE-2016-2806 https://access.redhat.com/security/cve/CVE-2016-2807 https://access.redhat.com/security/cve/CVE-2016-2808 https://access.redhat.com/security/cve/CVE-2016-2811 https://access.redhat.com/security/cve/CVE-2016-2812 https://access.redhat.com/security/cve/CVE-2016-2814 https://access.redhat.com/security/cve/CVE-2016-2816 https://access.redhat.com/security/cve/CVE-2016-2817 https://access.redhat.com/security/cve/CVE-2016-2820

1 0

[arch-security] [ASA-201604-14] squid: multiple issues
by Levente Polyak 23 Apr '16

23 Apr '16

Arch Linux Security Advisory ASA-201604-14 ========================================== Severity: Critical Date : 2016-04-23 CVE-ID : CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 Package : squid Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.17-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 3.5.17-1. # pacman -Syu "squid>=3.5.17-1" The problems have been fixed upstream in version 3.5.17. Workaround ========== None. Description =========== - CVE-2016-4051 (denial of service) Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid. - CVE-2016-4052 (denial of service) Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses. - CVE-2016-4053 (information disclosure) Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses. - CVE-2016-4054 (arbitrary code execution) Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses. Impact ====== A remote attacker is able to execute arbitrary code, disclose sensitive information or perform a denial of service attack via multiple vulnerabilities. References ========== http://www.squid-cache.org/Advisories/SQUID-2016_5.txt http://www.squid-cache.org/Advisories/SQUID-2016_6.txt https://access.redhat.com/security/cve/CVE-2016-4051 https://access.redhat.com/security/cve/CVE-2016-4052 https://access.redhat.com/security/cve/CVE-2016-4053 https://access.redhat.com/security/cve/CVE-2016-4054

1 0

[arch-security] [ASA-201604-13] samba: multiple issues
by Levente Polyak 22 Apr '16

22 Apr '16

Arch Linux Security Advisory ASA-201604-13 ========================================== Severity: High Date : 2016-04-23 CVE-ID : CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 Package : samba Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package samba before version 4.4.2-1 is vulnerable to multiple issues including but not limited to denial of service, man-in-the-middle, information disclosure and possibly arbitrary code execution. Resolution ========== Upgrade to 4.4.2-1. # pacman -Syu "samba>=4.4.2-1" The problems have been fixed upstream in version 4.4.2-1. Workaround ========== None. Description =========== - CVE-2015-5370 (arbitrary code execution) Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC). - CVE-2016-2110 (man-in-the-middle) Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection. - CVE-2016-2111 (information disclosure) An authentication flaw was found in Samba. When Samba is configured to act as a Domain Controller, it allows remote attackers to spoof the computer name of a secure channel's endpoints. The attacker could exploit this flaw to obtain sensitive session information by running a crafted application and leveraging the ability to sniff network traffic. - CVE-2016-2112 (man-in-the-middle) It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections. - CVE-2016-2113 (man-in-the-middle) It was found that while having a support for TLS/SSL for some protocols like ldap and http, certificates are not validated at all. When having a "tls cafile" option, configured certificate is not used to validate the server certificate. - CVE-2016-2114 (man-in-the-middle) It was found that Samba based active directory domain controller does not enforce smb signing and opens possibility for man-in-the-middle attacks. When Samba is configured as a Domain Controller, the default for the "server signing" should be "mandatory". During the early development of Samba 4 a new experimental file server located under source4/smb_server was used. But before the final 4.0.0 release upstream switched back to the file server under source3/smbd. But the logic for the correct default of "server signing" was not ported. - CVE-2016-2115 (man-in-the-middle) It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client. - CVE-2016-2118 (man-in-the-middle) It was reported that various samba versions are vulnerable to man in the middle attack where attacker can intercept any DCERPC traffic between a client and a server in order to impersonate the client and get the same privileges as the authenticated user account. This is most problematic against active directory domain controllers. Impact ====== A remote attacker on the same network is able to perform a man-in-the-middle and denial of service attack, disclose sensitive information and, under certain circumstances, possibly execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2015-5370 https://access.redhat.com/security/cve/CVE-2016-2110 https://access.redhat.com/security/cve/CVE-2016-2111 https://access.redhat.com/security/cve/CVE-2016-2112 https://access.redhat.com/security/cve/CVE-2016-2113 https://access.redhat.com/security/cve/CVE-2016-2114 https://access.redhat.com/security/cve/CVE-2016-2115 https://access.redhat.com/security/cve/CVE-2016-2118 https://www.samba.org/samba/security/CVE-2015-5370.html https://www.samba.org/samba/security/CVE-2016-2110.html https://www.samba.org/samba/security/CVE-2016-2111.html https://www.samba.org/samba/security/CVE-2016-2112.html https://www.samba.org/samba/security/CVE-2016-2113.html https://www.samba.org/samba/security/CVE-2016-2114.html https://www.samba.org/samba/security/CVE-2016-2115.html https://www.samba.org/samba/security/CVE-2016-2118.html

1 0

[arch-security] [ASA-201604-12] thunderbird: multiple issues
by Levente Polyak 22 Apr '16

22 Apr '16

Arch Linux Security Advisory ASA-201604-12 ========================================== Severity: Medium Date : 2016-04-23 CVE-ID : CVE-2016-1955 CVE-2016-1956 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.0-1 is vulnerable to multiple issues including denial of service and same-origin policy bypass. Resolution ========== Upgrade to 45.0-1. # pacman -Syu "thunderbird>=45.0-1" The problems have been fixed upstream in version 45.0. Workaround ========== None. Description =========== - CVE-2016-1955 (same-origin policy bypass) A vulnerability allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element. - CVE-2016-1956 (denial of service) Security researcher Ucha Gobejishvili reported a denial of service (DOS) attack when doing certain WebGL operations in a canvas requiring an unusually large amount buffer to be allocated from video memory. This resulted memory resource exhaustion with some Intel video cards, requiring the computer to be rebooted to return functionality. This was resolved by putting in additional checks on the amount of memory to be allocated during graphics processing. Impact ====== A remote attacker is able to bypass the same-origin policy restriction or perform a denial of service attack via memory consumption. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-18/ https://access.redhat.com/security/cve/CVE-2016-1955 https://access.redhat.com/security/cve/CVE-2016-1956

1 0

[arch-security] [ASA-201604-11] pgpdump: denial of service
by Levente Polyak 22 Apr '16

22 Apr '16

Arch Linux Security Advisory ASA-201604-11 ========================================== Severity: Low Date : 2016-04-22 CVE-ID : CVE-2016-4021 Package : pgpdump Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pgpdump before version 0.30-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.30-1. # pacman -Syu "pgpdump>=0.30-1" The problem has been fixed upstream in version 0.30. Workaround ========== None. Description =========== When pgpdump is run on specially crafted input, a denial of service condition occurs. The program runs with 100% CPU usage for an indefinite amount of time. This can be abused in scenarios where users can supply input to pgpdump, e.g. in http://www.pgpdump.net/. Impact ====== A remote attacker is able to create a specially crafted input that is leading to CPU resource consumption resulting in denial of service. References ========== https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4021

1 0

[arch-security] [ASA-201604-10] chromium: multiple issues
by Remi Gacogne 17 Apr '16

17 Apr '16

Arch Linux Security Advisory ASA-201604-10 ========================================== Severity: High Date : 2016-04-17 CVE-ID : CVE-2016-1651 CVE-2016-1652 CVE-2016-1653 CVE-2016-1654 CVE-2016-1655 CVE-2016-1657 CVE-2016-1658 CVE-2016-1659 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 50.0.2661.75-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 50.0.2661.75-1. # pacman -Syu "chromium>=50.0.2661.75-1" The problem has been fixed upstream in version 50.0.2661.75. Workaround ========== None. Description =========== - CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding. Credit to kdot working with HP's Zero Day Initiative. - CVE-2016-1652: Universal XSS in extension bindings. Credit to anonymous. - CVE-2016-1653: Out-of-bounds write in V8. Credit to Choongwoo Han. - CVE-2016-1654: Uninitialized memory read in media. Credit to Atte Kettunen of OUSPG. - CVE-2016-1655: Use-after-free related to extensions. Credit to Rob Wu. - CVE-2016-1657: Address bar spoofing. Credit to Luan Herrera. - CVE-2016-1658: Potential leak of sensitive information to malicious extensions. Credit to Antonio Sanso (@asanso) of Adobe. - CVE-2016-1659: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can access sensitive information, bypass security measures, cause a denial of service or have another unspecified impact on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/04/stable-channel-update_13.ht… https://access.redhat.com/security/cve/CVE-2016-1651 https://access.redhat.com/security/cve/CVE-2016-1652 https://access.redhat.com/security/cve/CVE-2016-1653 https://access.redhat.com/security/cve/CVE-2016-1654 https://access.redhat.com/security/cve/CVE-2016-1655 https://access.redhat.com/security/cve/CVE-2016-1657 https://access.redhat.com/security/cve/CVE-2016-1658 https://access.redhat.com/security/cve/CVE-2016-1659

1 0

[arch-security] [ASA-201604-9] libtasn1: denial of service
by Remi Gacogne 17 Apr '16

17 Apr '16

Arch Linux Security Advisory ASA-201604-9 ========================================= Severity: Medium Date : 2016-04-17 CVE-ID : CVE-2016-4008 Package : libtasn1 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libtasn1 before version 4.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.8-1. # pacman -Syu "libtasn1>=4.8-1" The problem has been fixed upstream in version 4.8. Workaround ========== None. Description =========== The libtasn1 library, in its 4.7 version, can loop for a long time or indefinitely when it is used to parse DER representations of X.509 certificates, leading to a denial of service. Some of these loops may in addition increase heap or stack usage, leading to more issues. Impact ====== A remote attacker can cause an application using a vulnerable version of libtasn1 to loop indefinitely by sending a crafted X.509 certificate, causing a denial of service. References ========== http://article.gmane.org/gmane.comp.security.oss.general/19286 https://access.redhat.com/security/cve/CVE-2016-4008 https://bugzilla.redhat.com/show_bug.cgi?id=1325965

1 0

[arch-security] [ASA-201604-8] lhasa: arbitrary code execution
by Levente Polyak 14 Apr '16

14 Apr '16

Arch Linux Security Advisory ASA-201604-8 ========================================= Severity: High Date : 2016-04-14 CVE-ID : CVE-2016-2347 Package : lhasa Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lhasa before version 0.3.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.3.1-1. # pacman -Syu "lhasa>=0.3.1-1" The problems has been fixed upstream in version 0.3.1 Workaround ========== None. Description =========== An exploitable integer underflow exists during calculation size for all headers in decode_level3_header function of Lhasa (lha) application. Smaller value of header_len than LEVEL_3_HEADER_LEN ( 32 ) cause during subtraction integer underflow and lead later to memory corruption via heap based buffer overflow. Impact ====== A remote attacker is able to create a specially crafted LHA archive that results in a heap based buffer overflow leading to arbitrary code execution. References ========== http://www.talosintel.com/reports/TALOS-2016-0095/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2347

1 0

[arch-security] [ASA-201604-7] flashplugin: multiple issues
by Levente Polyak 10 Apr '16

10 Apr '16

Arch Linux Security Advisory ASA-201604-7 ========================================= Severity: Critical Date : 2016-04-10 CVE-ID : CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013 CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017 CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.616-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, JIT spraying mitigation bypass and sandbox restriction bypass. Resolution ========== Upgrade to 11.2.202.616-1. # pacman -Syu "flashplugin>=11.2.202.616-1" The problems have been fixed upstream in version 11.2.202.616. Workaround ========== None. Description =========== - CVE-2016-1006 (JIT spraying mitigation bypass) These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations. - CVE-2016-1015 CVE-2016-1019 (arbitrary code execution) These updates resolve type confusion vulnerabilities that could lead to code execution. - CVE-2016-1011 CVE-2016-1013 CVE-2016-1016 CVE-2016-1017 CVE-2016-1031 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1012 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1032 CVE-2016-1033 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2016-1018 (arbitrary code execution) These updates resolve a stack overflow vulnerability that could lead to code execution. - CVE-2016-1030 (sandbox restriction bypass) These updates resolve a security bypass vulnerability. - CVE-2016-1014 (arbitrary code execution) These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution. Impact ====== A remote attacker is able to execute arbitrary code, bypass JIT spraying mitigations and bypass sandbox restrictions via multiple vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsa16-01.html https://helpx.adobe.com/security/products/flash-player/apsb16-10.html https://access.redhat.com/security/cve/CVE-2016-1006 https://access.redhat.com/security/cve/CVE-2016-1011 https://access.redhat.com/security/cve/CVE-2016-1012 https://access.redhat.com/security/cve/CVE-2016-1013 https://access.redhat.com/security/cve/CVE-2016-1014 https://access.redhat.com/security/cve/CVE-2016-1015 https://access.redhat.com/security/cve/CVE-2016-1016 https://access.redhat.com/security/cve/CVE-2016-1017 https://access.redhat.com/security/cve/CVE-2016-1018 https://access.redhat.com/security/cve/CVE-2016-1019 https://access.redhat.com/security/cve/CVE-2016-1020 https://access.redhat.com/security/cve/CVE-2016-1021 https://access.redhat.com/security/cve/CVE-2016-1022 https://access.redhat.com/security/cve/CVE-2016-1023 https://access.redhat.com/security/cve/CVE-2016-1024 https://access.redhat.com/security/cve/CVE-2016-1025 https://access.redhat.com/security/cve/CVE-2016-1026 https://access.redhat.com/security/cve/CVE-2016-1027 https://access.redhat.com/security/cve/CVE-2016-1028 https://access.redhat.com/security/cve/CVE-2016-1029 https://access.redhat.com/security/cve/CVE-2016-1030 https://access.redhat.com/security/cve/CVE-2016-1031 https://access.redhat.com/security/cve/CVE-2016-1032 https://access.redhat.com/security/cve/CVE-2016-1033

1 0

[arch-security] [ASA-201604-6] mercurial: arbitrary code execution
by Levente Polyak 06 Apr '16

06 Apr '16

Arch Linux Security Advisory ASA-201604-6 ========================================= Severity: Critical Date : 2016-04-06 CVE-ID : CVE-2016-3068 CVE-2016-3069 CVE-2016-3630 Package : mercurial Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mercurial before version 3.7.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.7.3-1. # pacman -Syu "mercurial>=3.7.3-1" The problems have been fixed upstream in version 3.7.3. Workaround ========== None. Description =========== - CVE-2016-3068 (arbitrary code execution) It was reported that in mercurial, there is similar vulnerability as CVE-2015-7545 in git. Git's git-remote-ext remote helper provides an ext:: URL scheme that allows running arbitrary shell commands. Mercurial allows specifying git repositories as subrepositories. Git ext:: URLs can be specified as Mercurial subrepositories allowing arbitrary shell commands to be run on `hg clone`. - CVE-2016-3069 (arbitrary code execution) It was reported that Convert extension in mercurial is vulnerable to command execution. Incorrect handling of command line parameters allows passing a full Git remote URL via a directory name. The Git ext:: URL scheme can be used to obtain arbitrary command execution. Furthermore, lack of escaping of shell metacharacters allows arbitrary command injection, which is another way of exploiting the vulnerable code. - CVE-2016-3630 (arbitrary code execution) Two bounds-checking errors have been discovered in the binary delta decoder that may be exploitable via clone, push, or pull leading to arbitrary code execution. Impact ====== A remote attacker is able to execute arbitrary code via the mercurial convert extension, git subrepositories or a vulnerability in the binary delta decoder. References ========== https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29 https://access.redhat.com/security/cve/CVE-2016-3068 https://access.redhat.com/security/cve/CVE-2016-3069 https://access.redhat.com/security/cve/CVE-2016-3630 https://bugs.archlinux.org/task/48821

1 0