May 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201605-28] chromium: multiple issues
by Remi Gacogne 28 May '16

28 May '16

Arch Linux Security Advisory ASA-201605-28 ========================================== Severity: High Date : 2016-05-28 CVE-ID : CVE-2016-1672 CVE-2016-1673 CVE-2016-1674 CVE-2016-1675 CVE-2016-1676 CVE-2016-1677 CVE-2016-1678 CVE-2016-1679 CVE-2016-1680 CVE-2016-1681 CVE-2016-1682 CVE-2016-1683 CVE-2016-1684 CVE-2016-1685 CVE-2016-1686 CVE-2016-1687 CVE-2016-1688 CVE-2016-1689 CVE-2016-1690 CVE-2016-1691 CVE-2016-1692 CVE-2016-1693 CVE-2016-1694 CVE-2016-1695 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 51.0.2704.63-1 is vulnerable to multiple issues including but not limited to policy bypass, denial of service, information leak and arbitrary code execution. Resolution ========== Upgrade to 51.0.2704.63-1. # pacman -Syu "chromium>=51.0.2704.63-1" The problem has been fixed upstream in version 51.0.2704.63. Workaround ========== None. Description =========== - CVE-2016-1672: Cross-origin bypass in extension bindings. Credit to Mariusz Mlynski. - CVE-2016-1673: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1674: Cross-origin bypass in extensions. Credit to Mariusz Mlynski. - CVE-2016-1675: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1676: Cross-origin bypass in extension bindings. Credit to Rob Wu. - CVE-2016-1677: Type confusion in V8. Credit to Guang Gong of Qihoo 360. - CVE-2016-1678: Heap overflow in V8. Credit to Christian Holler. - CVE-2016-1679: Heap use-after-free in V8 bindings. Credit to Rob Wu. - CVE-2016-1680: Heap use-after-free in Skia. Credit to Atte Kettunen of OUSPG. - CVE-2016-1681: Heap overflow in PDFium. Credit to Aleksandar Nikolic of Cisco Talos. - CVE-2016-1682: CSP bypass for ServiceWorker. Credit to KingstonTime. - CVE-2016-1683: Out-of-bounds access in libxslt. Credit to Nicolas Gregoire. - CVE-2016-1684: Integer overflow in libxslt. Credit to Nicolas Gregoire. - CVE-2016-1685: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB. - CVE-2016-1686: Out-of-bounds read in PDFium. Credit to Ke Liu of Tencent's Xuanwu LAB. - CVE-2016-1687: Information leak in extensions. Credit to Rob Wu. - CVE-2016-1688: Out-of-bounds read in V8. Credit to Max Korenko. - CVE-2016-1689: Heap buffer overflow in media. Credit to Atte Kettunen of OUSPG. - CVE-2016-1690: Heap use-after-free in Autofill. Credit to Rob Wu. - CVE-2016-1691: Heap buffer-overflow in Skia. Credit to Atte Kettunen of OUSPG. - CVE-2016-1692: Limited cross-origin bypass in ServiceWorker. Credit to Til Jasper Ullrich. - CVE-2016-1693: HTTP Download of Software Removal Tool. Credit to Khalil Zhani. - CVE-2016-1694: HPKP pins removed on cache clearance. Credit to Ryan Lester and Bryant Zadegan. - CVE-2016-1695: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can access sensitive information, cause a denial of service by application crash or possibly execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/05/stable-channel-update_25.ht… https://access.redhat.com/security/cve/CVE-2016-1672 https://access.redhat.com/security/cve/CVE-2016-1673 https://access.redhat.com/security/cve/CVE-2016-1674 https://access.redhat.com/security/cve/CVE-2016-1675 https://access.redhat.com/security/cve/CVE-2016-1676 https://access.redhat.com/security/cve/CVE-2016-1677 https://access.redhat.com/security/cve/CVE-2016-1678 https://access.redhat.com/security/cve/CVE-2016-1679 https://access.redhat.com/security/cve/CVE-2016-1680 https://access.redhat.com/security/cve/CVE-2016-1681 https://access.redhat.com/security/cve/CVE-2016-1682 https://access.redhat.com/security/cve/CVE-2016-1683 https://access.redhat.com/security/cve/CVE-2016-1684 https://access.redhat.com/security/cve/CVE-2016-1685 https://access.redhat.com/security/cve/CVE-2016-1686 https://access.redhat.com/security/cve/CVE-2016-1687 https://access.redhat.com/security/cve/CVE-2016-1688 https://access.redhat.com/security/cve/CVE-2016-1689 https://access.redhat.com/security/cve/CVE-2016-1690 https://access.redhat.com/security/cve/CVE-2016-1691 https://access.redhat.com/security/cve/CVE-2016-1692 https://access.redhat.com/security/cve/CVE-2016-1693 https://access.redhat.com/security/cve/CVE-2016-1694 https://access.redhat.com/security/cve/CVE-2016-1695

1 0

[arch-security] [ASA-201605-27] libxml2: multiple issues
by Levente Polyak 26 May '16

26 May '16

Arch Linux Security Advisory ASA-201605-27 ========================================== Severity: High Date : 2016-05-26 CVE-ID : CVE-2016-1762 CVE-2016-1833 CVE-2016-1834 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-3627 CVE-2016-3705 CVE-2016-4483 Package : libxml2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libxml2 before version 2.9.4+0+gbdec218-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.9.4+0+gbdec218-2. # pacman -Syu "libxml2>=2.9.4+0+gbdec218-2" The problems have been fixed upstream in version 2.9.4. Workaround ========== None. Description =========== - CVE-2016-1762 (denial of service) A vulnerability has been discovered that allows remote attackers to cause a denial of service (memory corruption) via a crafted XML document. - CVE-2016-1833 (denial of service) A maliciously crafted file could cause the application to crash due to a heap-based out-of-bounds memory read. - CVE-2016-1834 (arbitrary code execution) It has been discovered that a heap-buffer-overflow could happen in xmlStrncat. - CVE-2016-1835 (arbitrary code execution) It has been discovered that a maliciously crafted file could cause the application to crash due to a heap use-after-free in xmlSAX2AttributeNs. - CVE-2016-1836 (arbitrary code execution) It has been discovered that a heap-use-after free can happen in the xmlDictComputeFastKey. - CVE-2016-1837 (arbitrary code execution) It has been discovered that a maliciously crafted file could cause the application to crash due to a Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral. - CVE-2016-1838 (denial of service) It has been discovered that a heap-based buffer overread could happen in xmlParserPrintFileContextInternal - CVE-2016-1839 (denial of service) It has been discovered that a heap-based buffer overread could happen in xmlDictAddString. - CVE-2016-1840 (arbitrary code execution) It has been discovered that a heap-buffer overflow could happen in xmlFAParsePosCharGroup - CVE-2016-3627 (denial of service) A vulnerability was found in a way libxml2 parses certain files. With the libxml2 in recovery mode, a maliciously crafted filed could cause libxml2 to crash. - CVE-2016-3705 (arbitrary code execution) It is possible to trigger a stack overflow using a carefully crafted invalid XML file, the stack overflow occurs before libxml2 determines the XML file is invalid. - CVE-2016-4483 (denial of service) It has been discovered that parsing a maliciously crafted XML file could cause the application to crash if recover mode is used. Impact ====== A remote attacker is able to use a carefully crafted XML file that, when processed, is leading to denial of service or arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-1762 https://access.redhat.com/security/cve/CVE-2016-1833 https://access.redhat.com/security/cve/CVE-2016-1834 https://access.redhat.com/security/cve/CVE-2016-1835 https://access.redhat.com/security/cve/CVE-2016-1836 https://access.redhat.com/security/cve/CVE-2016-1837 https://access.redhat.com/security/cve/CVE-2016-1838 https://access.redhat.com/security/cve/CVE-2016-1839 https://access.redhat.com/security/cve/CVE-2016-1840 https://access.redhat.com/security/cve/CVE-2016-3627 https://access.redhat.com/security/cve/CVE-2016-3705 https://access.redhat.com/security/cve/CVE-2016-4483

1 0

[arch-security] [ASA-201605-26] libndp: man-in-the-middle
by Levente Polyak 24 May '16

24 May '16

Arch Linux Security Advisory ASA-201605-26 ========================================== Severity: Medium Date : 2016-05-24 CVE-ID : CVE-2016-3698 Package : libndp Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libndp before version 1.6-1 is vulnerable to man-in-the-middle attacks. Resolution ========== Upgrade to 1.6-1. # pacman -Syu "libndp>=1.6-1" The problem has been fixed upstream in version 1.6 Workaround ========== None. Description =========== Libndp before version 1.6 does properly validate and check the origin of Neighbor Discovery Protocol (NDP) messages. An attacker on a non-local network can exploit this flaw to advertise a node as a router, which allows them to re-route the traffic through an attacker-controlled node. Impact ====== A remote unauthenticated attacker is able to send specially crafted messages to a client and act as a man-in-the-middle between the client and a server or disrupt client traffic. References ========== https://access.redhat.com/security/cve/CVE-2016-3698 https://github.com/jpirko/libndp/commit/2af9a55b38b55abbf05fd116ec097d40291…

1 0

[arch-security] [ASA-201605-25] bugzilla: cross-site scripting
by Levente Polyak 19 May '16

19 May '16

Arch Linux Security Advisory ASA-201605-25 ========================================== Severity: Medium Date : 2016-05-19 CVE-ID : CVE-2016-2803 Package : bugzilla Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bugzilla before version 5.0.3-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 5.0.3-1. # pacman -Syu "bugzilla>=5.0.3-1" The problem has been fixed upstream in version 5.0.3. Workaround ========== None. Description =========== An attacker can craft a malicious summary within a bug report to host malicious javascript code. This code will be served to a user when he or she navigates to the bug's dependency graph. Impact ====== An attacker is able to submit a malicious bug report and execute arbitrary javascript code in the client's browser by using the bugzilla server as a pivot. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2803 https://bugzilla.mozilla.org/show_bug.cgi?id=1253263

1 0

[arch-security] [ASA-201605-24] p7zip: arbitrary code execution
by Levente Polyak 18 May '16

18 May '16

Arch Linux Security Advisory ASA-201605-24 ========================================== Severity: Critical Date : 2016-05-18 CVE-ID : CVE-2016-2334 CVE-2016-2335 Package : p7zip Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package p7zip before version 15.14.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 15.14.1-2. # pacman -Syu "p7zip>=15.14.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2016-2334 (arbitrary code execution) An exploitable heap overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method functionality of 7zip that can lead to arbitrary code execution. Before decompression, ExtractZlibFile method read block size and its offset from file and after that read block data into static size buffer "buf". Because there is no check whether size of block is bigger than size of "buf", malformed size of block exceeding mentioned "buf" size will cause buffer overflow and heap corruption. - CVE-2016-2335 (arbitrary code execution) An out of bound read vulnerability exists in the CInArchive::ReadFileItem method functionality of 7zip for handling UDF files that can lead to denial of service or code execution. Because volumes can have more than one partition map their objects are keep in object vector. To start looking for item, method tries to achieve proper partition object using to this mentioned partition maps object vector and "PartitionRef" field from Long Allocation Descriptor. Lack of checking whether "PartitionRef" field is bigger than available amount of partition map objects cause read out of bounds and can lead in some circumstances to arbitrary code execution. Impact ====== A remote attacker is able to use a specially crafted archive that, when processed, is leading to arbitrary code execution. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2334 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2335 http://www.talosintel.com/reports/TALOS-2016-0093/ http://www.talosintel.com/reports/TALOS-2016-0094/

1 0

[arch-security] [ASA-201605-23] lib32-expat: arbitrary code execution
by Levente Polyak 18 May '16

18 May '16

Arch Linux Security Advisory ASA-201605-23 ========================================== Severity: Critical Date : 2016-05-18 CVE-ID : CVE-2015-1283 CVE-2016-0718 Package : lib32-expat Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-expat before version 2.1.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.1.1-2. # pacman -Syu "lib32-expat>=2.1.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-1283 (arbitrary code execution) Multiple integer overflows in the XML_GetBuffer function allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly arbitrary code execution via crafted XML data. This problem has already been fixed in version 2.1.0-1 but this update refreshes the fix to avoid relying on undefined behavior. - CVE-2016-0718 (arbitrary code execution) The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution. Impact ====== A remote attacker is able to use a specially crafted XML file that, when processed, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-1283 https://access.redhat.com/security/cve/CVE-2016-0718 http://seclists.org/oss-sec/2016/q2/360

1 0

[arch-security] [ASA-201605-22] expat: arbitrary code execution
by Levente Polyak 18 May '16

18 May '16

Arch Linux Security Advisory ASA-201605-22 ========================================== Severity: Critical Date : 2016-05-18 CVE-ID : CVE-2015-1283 CVE-2016-0718 Package : expat Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package expat before version 2.1.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.1.1-2. # pacman -Syu "expat>=2.1.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-1283 (arbitrary code execution) Multiple integer overflows in the XML_GetBuffer function allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly arbitrary code execution via crafted XML data. This problem has already been fixed in version 2.1.0-1 but this update refreshes the fix to avoid relying on undefined behavior. - CVE-2016-0718 (arbitrary code execution) The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution. Impact ====== A remote attacker is able to use a specially crafted XML file that, when processed, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-1283 https://access.redhat.com/security/cve/CVE-2016-0718 http://seclists.org/oss-sec/2016/q2/360

1 0

[arch-security] [ASA-201605-21] thunderbird: arbitrary code execution
by Remi Gacogne 15 May '16

15 May '16

Arch Linux Security Advisory ASA-201605-21 ========================================== Severity: Critical Date : 2016-05-15 CVE-ID : CVE-2016-2804 CVE-2016-2805 CVE-2016-2806 CVE-2016-2807 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.1.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.1.0-1. # pacman -Syu "thunderbird>=45.1.0-1" The problem has been fixed upstream in version 45.1.0. Workaround ========== None. Description =========== - CVE-2016-2804: Gary Kwong, Christian Holler, Andrew McCreight, Boris Zbarsky, and Steve Fink reported memory safety problems and crashes. - CVE-2016-2805: Christian Holler reported a memory safety problem. - CVE-2016-2806: Gary Kwong, Christian Holler, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, and Randell Jesup reported memory safety problems and crashes. - CVE-2016-2807: Christian Holler, Tyson Smith, and Phil Ringalda reported memory safety problems and crashes. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-39/ https://access.redhat.com/security/cve/CVE-2016-2804 https://access.redhat.com/security/cve/CVE-2016-2805 https://access.redhat.com/security/cve/CVE-2016-2806 https://access.redhat.com/security/cve/CVE-2016-2807

1 0

[arch-security] [ASA-201605-20] lib32-glibc: multiple issues
by Levente Polyak 13 May '16

13 May '16

Arch Linux Security Advisory ASA-201605-20 ========================================== Severity: Medium Date : 2016-05-13 CVE-ID : CVE-2016-1234 CVE-2016-3706 Package : lib32-glibc Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.23-4 is vulnerable to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 2.23-4. # pacman -Syu "lib32-glibc>=2.23-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2016-1234 (arbitrary code execution) It was found that glob implementation in glibc does not correctly handle overlong names in struct dirent buffers when GLOB_ALTDIRFUNC is used, causing a large stack-based buffer overflow with controlled length and content. - CVE-2016-3706 (denial of service) A stack (frame) overflow flaw, which could lead to a denial of service (application crash), was found in the way glibc's getaddrinfo() function processed certain requests when called with AF_INET or AF_INET6. Impact ====== A remote attacker is able to perform a denial of service attack via a vulnerability in the getaddrinfo() function. Furthermore a local attacker may be able to execute arbitrary code via a buffer overflow when GLOB_ALTDIRFUNC is used. References ========== https://access.redhat.com/security/cve/CVE-2016-1234 https://access.redhat.com/security/cve/CVE-2016-3706 https://sourceware.org/bugzilla/show_bug.cgi?id=19779 https://sourceware.org/bugzilla/show_bug.cgi?id=20010

1 0

[arch-security] [ASA-201605-19] glibc: multiple issues
by Levente Polyak 13 May '16

13 May '16

Arch Linux Security Advisory ASA-201605-19 ========================================== Severity: Medium Date : 2016-05-13 CVE-ID : CVE-2016-1234 CVE-2016-3706 Package : glibc Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.23-4 is vulnerable to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 2.23-4. # pacman -Syu "glibc>=2.23-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2016-1234 (arbitrary code execution) It was found that glob implementation in glibc does not correctly handle overlong names in struct dirent buffers when GLOB_ALTDIRFUNC is used, causing a large stack-based buffer overflow with controlled length and content. - CVE-2016-3706 (denial of service) A stack (frame) overflow flaw, which could lead to a denial of service (application crash), was found in the way glibc's getaddrinfo() function processed certain requests when called with AF_INET or AF_INET6. Impact ====== A remote attacker is able to perform a denial of service attack via a vulnerability in the getaddrinfo() function. Furthermore a local attacker may be able to execute arbitrary code via a buffer overflow when GLOB_ALTDIRFUNC is used. References ========== https://access.redhat.com/security/cve/CVE-2016-1234 https://access.redhat.com/security/cve/CVE-2016-3706 https://sourceware.org/bugzilla/show_bug.cgi?id=19779 https://sourceware.org/bugzilla/show_bug.cgi?id=20010

1 0