April 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201604-5] optipng: arbitrary code execution
by Levente Polyak 04 Apr '16

04 Apr '16

Arch Linux Security Advisory ASA-201604-5 ========================================= Severity: High Date : 2016-04-04 CVE-ID : CVE-2016-2191 Package : optipng Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package optipng before version 0.7.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.7.6-1. # pacman -Syu "optipng>=0.7.6-1" The problem has been fixed upstream in version 0.7.6. Workaround ========== None. Description =========== An invalid write may occur in optipng before version 0.7.6 while processing bitmap images due to `crt_row' being (inc|dec)remented without any boundary checking when encountering delta escapes. This issue can possibly be used to execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted bitmap image file to execute arbitrary code. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2191 https://sourceforge.net/p/optipng/bugs/59/ http://www.openwall.com/lists/oss-security/2016/04/04/2

1 0

[arch-security] [ASA-201604-4] Squid: denial of service
by Jelle van der Waa 02 Apr '16

02 Apr '16

Arch Linux Security Advisory ASA-201604-4 ========================================= Severity: Low, Medium, High, Critical Date : 2016-04-02 CVE-ID : CVE-2016-3947 Package : squid Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.16-1. # pacman -Syu "squid>=3.5.16-1" The problem has been fixed upstream in version 3.5.16. Workaround ========== None. Description =========== Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses. Impact ====== This problem allows a malicious client script and remote server delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service. References ========== http://article.gmane.org/gmane.comp.security.oss.general/19234 http://www.squid-cache.org/Advisories/SQUID-2016_4.txt

1 0

[arch-security] [ASA-201604-3] jre7-openjdk-headless: sandbox escape
by Levente Polyak 01 Apr '16

01 Apr '16

Arch Linux Security Advisory ASA-201604-3 ========================================= Severity: Critical Date : 2016-04-01 CVE-ID : CVE-2016-0636 Package : jre7-openjdk-headless Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk-headless before version 7.u99_2.6.5-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 7.u99_2.6.5-1. # pacman -Syu "jre7-openjdk-headless>=7.u99_2.6.5-1" The problem has been fixed upstream in version 7.u99_2.6.5. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0

[arch-security] [ASA-201604-2] jre7-openjdk: sandbox escape
by Levente Polyak 01 Apr '16

01 Apr '16

Arch Linux Security Advisory ASA-201604-2 ========================================= Severity: Critical Date : 2016-04-01 CVE-ID : CVE-2016-0636 Package : jre7-openjdk Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u99_2.6.5-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 7.u99_2.6.5-1. # pacman -Syu "jre7-openjdk>=7.u99_2.6.5-1" The problem has been fixed upstream in version 7.u99_2.6.5. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0

[arch-security] [ASA-201604-1] jdk7-openjdk: sandbox escape
by Levente Polyak 01 Apr '16

01 Apr '16

Arch Linux Security Advisory ASA-201604-1 ========================================= Severity: Critical Date : 2016-04-01 CVE-ID : CVE-2016-0636 Package : jdk7-openjdk Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u99_2.6.5-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 7.u99_2.6.5-1. # pacman -Syu "jdk7-openjdk>=7.u99_2.6.5-1" The problem has been fixed upstream in version 7.u99_2.6.5. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0