May 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201605-18] lib32-flashplugin: arbitrary code execution
by Levente Polyak 12 May '16

12 May '16

Arch Linux Security Advisory ASA-201605-18 ========================================== Severity: Critical Date : 2016-05-12 CVE-ID : CVE-2016-1096 CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115 CVE-2016-4116 CVE-2016-4117 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.621-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.621-1. # pacman -Syu "lib32-flashplugin>=11.2.202.621-1" The problem has been fixed upstream in version 11.2.202.621. Workaround ========== None. Description =========== - CVE-2016-1096: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1097: Use-after-free. Wen Guanxing from Pangu LAB, working with the Chromium Vulnerability Rewards Program . - CVE-2016-1098: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1099: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1100: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1101: Heap buffer overflow. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1102: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1103: Buffer overflow. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1104: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1105: Type confusion. Natalie Silvanovich of Google Project Zero. - CVE-2016-1106: Use-after-free. Natalie Silvanovich of Google Project Zero. - CVE-2016-1107: Use-after-free. NSFOCUS Security Team. - CVE-2016-1108: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-1109: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-1110: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-4108: Use-after-free. Natalie Silvanovich of Google Project Zero. - CVE-2016-4109: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4110: Use-after-free. willJ of Tencent PC Manager. - CVE-2016-4111: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4112: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4113: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4114: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4115: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4116: Vulnerability in the directory search path used to find resources. Ladislav Baco of CSIRT.SK. - CVE-2016-4117: Type confusion vulnerability that could lead to code execution. Genwei Jiang of FireEye, Inc. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsa16-02.html https://access.redhat.com/security/cve/CVE-2016-1096 https://access.redhat.com/security/cve/CVE-2016-1097 https://access.redhat.com/security/cve/CVE-2016-1098 https://access.redhat.com/security/cve/CVE-2016-1099 https://access.redhat.com/security/cve/CVE-2016-1100 https://access.redhat.com/security/cve/CVE-2016-1101 https://access.redhat.com/security/cve/CVE-2016-1102 https://access.redhat.com/security/cve/CVE-2016-1103 https://access.redhat.com/security/cve/CVE-2016-1104 https://access.redhat.com/security/cve/CVE-2016-1105 https://access.redhat.com/security/cve/CVE-2016-1106 https://access.redhat.com/security/cve/CVE-2016-1107 https://access.redhat.com/security/cve/CVE-2016-1108 https://access.redhat.com/security/cve/CVE-2016-1109 https://access.redhat.com/security/cve/CVE-2016-1110 https://access.redhat.com/security/cve/CVE-2016-4108 https://access.redhat.com/security/cve/CVE-2016-4109 https://access.redhat.com/security/cve/CVE-2016-4110 https://access.redhat.com/security/cve/CVE-2016-4111 https://access.redhat.com/security/cve/CVE-2016-4112 https://access.redhat.com/security/cve/CVE-2016-4113 https://access.redhat.com/security/cve/CVE-2016-4114 https://access.redhat.com/security/cve/CVE-2016-4115 https://access.redhat.com/security/cve/CVE-2016-4116 https://access.redhat.com/security/cve/CVE-2016-4117

1 0

[arch-security] [ASA-201605-17] libksba: denial of service
by Remi Gacogne 12 May '16

12 May '16

Arch Linux Security Advisory ASA-201605-17 ========================================== Severity: Medium Date : 2016-05-12 CVE-ID : CVE-2016-4574 Package : libksba Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libksba before version 1.3.4-1 is vulnerable to denial of service or other unspecified impact. Resolution ========== Upgrade to 1.3.4-1. # pacman -Syu "libksba>=1.3.4-1" The problem has been fixed upstream in version 1.3.4. Workaround ========== None. Description =========== An out-of-bound read access due to incorrect utf-8 strings handling has been in found in the _ksba_dn_to_str() function. This issue is due to an incomplete fix for CVE-2016-4356, caused by an off-by-one error when handling incorrect utf-8 strings. Impact ====== A remote attacker might be able to crash the application using libksba, causing a denial of service, or have other unspecified impact. References ========== https://bugs.archlinux.org/task/49289 http://www.openwall.com/lists/oss-security/2016/05/10/4 https://access.redhat.com/security/cve/CVE-2016-4574

1 0

[arch-security] [ASA-201605-16] flashplugin: arbitrary code execution
by Remi Gacogne 12 May '16

12 May '16

Arch Linux Security Advisory ASA-201605-16 ========================================== Severity: Critical Date : 2016-05-12 CVE-ID : CVE-2016-1096 CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115 CVE-2016-4116 CVE-2016-4117 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.621-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.621-1. # pacman -Syu "flashplugin>=11.2.202.621-1" The problem has been fixed upstream in version 11.2.202.621. Workaround ========== None. Description =========== - CVE-2016-1096: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1097: Use-after-free. Wen Guanxing from Pangu LAB, working with the Chromium Vulnerability Rewards Program . - CVE-2016-1098: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1099: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1100: Memory corruption. Wen Guanxing from Pangu LAB. - CVE-2016-1101: Heap buffer overflow. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1102: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1103: Buffer overflow. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1104: Memory corruption. Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2016-1105: Type confusion. Natalie Silvanovich of Google Project Zero. - CVE-2016-1106: Use-after-free. Natalie Silvanovich of Google Project Zero. - CVE-2016-1107: Use-after-free. NSFOCUS Security Team. - CVE-2016-1108: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-1109: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-1110: Use-after-free. Nicolas Joly of Microsoft Vulnerability Research. - CVE-2016-4108: Use-after-free. Natalie Silvanovich of Google Project Zero. - CVE-2016-4109: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4110: Use-after-free. willJ of Tencent PC Manager. - CVE-2016-4111: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4112: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4113: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4114: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4115: Memory corruption. willJ of Tencent PC Manager. - CVE-2016-4116: Vulnerability in the directory search path used to find resources. Ladislav Baco of CSIRT.SK. - CVE-2016-4117: Type confusion vulnerability that could lead to code execution. Genwei Jiang of FireEye, Inc. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsa16-02.html https://access.redhat.com/security/cve/CVE-2016-1096 https://access.redhat.com/security/cve/CVE-2016-1097 https://access.redhat.com/security/cve/CVE-2016-1098 https://access.redhat.com/security/cve/CVE-2016-1099 https://access.redhat.com/security/cve/CVE-2016-1100 https://access.redhat.com/security/cve/CVE-2016-1101 https://access.redhat.com/security/cve/CVE-2016-1102 https://access.redhat.com/security/cve/CVE-2016-1103 https://access.redhat.com/security/cve/CVE-2016-1104 https://access.redhat.com/security/cve/CVE-2016-1105 https://access.redhat.com/security/cve/CVE-2016-1106 https://access.redhat.com/security/cve/CVE-2016-1107 https://access.redhat.com/security/cve/CVE-2016-1108 https://access.redhat.com/security/cve/CVE-2016-1109 https://access.redhat.com/security/cve/CVE-2016-1110 https://access.redhat.com/security/cve/CVE-2016-4108 https://access.redhat.com/security/cve/CVE-2016-4109 https://access.redhat.com/security/cve/CVE-2016-4110 https://access.redhat.com/security/cve/CVE-2016-4111 https://access.redhat.com/security/cve/CVE-2016-4112 https://access.redhat.com/security/cve/CVE-2016-4113 https://access.redhat.com/security/cve/CVE-2016-4114 https://access.redhat.com/security/cve/CVE-2016-4115 https://access.redhat.com/security/cve/CVE-2016-4116 https://access.redhat.com/security/cve/CVE-2016-4117

1 0

[arch-security] [ASA-201605-15] chromium: multiple issues
by Remi Gacogne 12 May '16

12 May '16

Arch Linux Security Advisory ASA-201605-15 ========================================== Severity: High Date : 2016-05-12 CVE-ID : CVE-2016-1667 CVE-2016-1668 CVE-2016-1669 CVE-2016-1670 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 50.0.2661.102-1 is vulnerable to multiple issues including same-origin policy bypass, denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 50.0.2661.102-1. # pacman -Syu "chromium>=50.0.2661.102-1" The problem has been fixed upstream in version 50.0.2661.102. Workaround ========== None. Description =========== - CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski. - CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han. - CVE-2016-1670: Race condition in loader. Credit to anonymous. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, cause a denial of service by crashing the application or possibly execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/05/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2016-1667 https://access.redhat.com/security/cve/CVE-2016-1668 https://access.redhat.com/security/cve/CVE-2016-1669 https://access.redhat.com/security/cve/CVE-2016-1670

1 0

[arch-security] [ASA-201605-14] cacti: sql injection
by Remi Gacogne 10 May '16

10 May '16

Arch Linux Security Advisory ASA-201605-14 ========================================== Severity: Medium Date : 2016-05-10 CVE-ID : CVE-2016-3659 Package : cacti Type : sql injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package cacti before version 0.8.8_h-1 is vulnerable to sql injection. Resolution ========== Upgrade to 0.8.8_h-1. # pacman -Syu "cacti>=0.8.8_h-1" The problem has been fixed upstream in version 0.8.8h. Workaround ========== None. Description =========== A SQL injection vulnerability has been found in cacti, in the the host_group_data parameter of the graph_view.php file. Impact ====== A remote authenticated attacker can execute arbitrary SQL command on the affected host. References ========== http://bugs.cacti.net/view.php?id=2673 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3659

1 0

[arch-security] [ASA-201605-13] squid: multiple issues
by Remi Gacogne 10 May '16

10 May '16

Arch Linux Security Advisory ASA-201605-13 ========================================== Severity: Medium Date : 2016-05-10 CVE-ID : CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 Package : squid Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.19-1 is vulnerable to multiple issues including denial of service, cache poisoning and same-origin policy bypass. Resolution ========== Upgrade to 3.5.19-1. # pacman -Syu "squid>=3.5.19-1" The problem has been fixed upstream in version 3.5.18. Workaround ========== None. Description =========== - CVE-2016-4554 (cache poisoning, same-origin policy bypass): Due to incorrect input validation, Squid is vulnerable to a header smuggling attack leading to cache poisoning and bypass of the same-origin security policy in Squid and some client browsers. - CVE-2016-4555, CVE-2016-4556 (denial of service): Due to incorrect pointer handling and reference counting, Squid is vulnerable to a denial of service attack when processing ESI responses. Impact ====== A remote attacker can smuggle a Host header value past some-origin security protections to cause Squid to contact the wrong origin server. This can also be used to poison a downstream cache storing the response, browser or forward proxy, if this cache does not follow RFC 7230 and lets the smuggled value through. A remote attacker controlling a downstream server can trigger a denial of service by delivering a crafted ESI response. References ========== http://www.squid-cache.org/Advisories/SQUID-2016_8.txt http://www.squid-cache.org/Advisories/SQUID-2016_9.txt https://access.redhat.com/security/cve/CVE-2016-4554 https://access.redhat.com/security/cve/CVE-2016-4555 https://access.redhat.com/security/cve/CVE-2016-4556

1 0

[arch-security] [ASA-201605-12] mencoder: denial of service
by Levente Polyak 07 May '16

07 May '16

Arch Linux Security Advisory ASA-201605-12 ========================================== Severity: Medium Date : 2016-05-07 CVE-ID : CVE-2016-4352 Package : mencoder Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mencoder before version 37857-1 is vulnerable to denial of service. Resolution ========== Upgrade to 37857-1. # pacman -Syu "mencoder>=37857-1" The problem has been fixed upstream in version 37857. Workaround ========== None. Description =========== A vulnerability has been discovered that is leading to a crash when playing a fuzzed gif file. The gif demuxes assumed in many places that width*height is <= INT_MAX, however this was not always true and was leading to an integer overflow. Impact ====== A remote attacker is able to use a specially crafted gid file that, when processed, is resulting in an application crash leading to denial of service. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4352 http://www.openwall.com/lists/oss-security/2016/04/29/7 https://bugs.archlinux.org/task/49195 https://trac.mplayerhq.hu/ticket/2295

1 0

[arch-security] [ASA-201605-11] mplayer: denial of service
by Levente Polyak 07 May '16

07 May '16

Arch Linux Security Advisory ASA-201605-11 ========================================== Severity: Medium Date : 2016-05-07 CVE-ID : CVE-2016-4352 Package : mplayer Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mplayer before version 37857-1 is vulnerable to denial of service. Resolution ========== Upgrade to 37857-1. # pacman -Syu "mplayer>=37857-1" The problem has been fixed upstream in version 37857. Workaround ========== None. Description =========== A vulnerability has been discovered that is leading to a crash when playing a fuzzed gif file. The gif demuxes assumed in many places that width*height is <= INT_MAX, however this was not always true and was leading to an integer overflow. Impact ====== A remote attacker is able to use a specially crafted gid file that, when processed, is resulting in an application crash leading to denial of service. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4352 http://www.openwall.com/lists/oss-security/2016/04/29/7 https://bugs.archlinux.org/task/49195 https://trac.mplayerhq.hu/ticket/2295

1 0

[arch-security] [ASA-201605-10] mercurial: arbitrary code execution
by Remi Gacogne 06 May '16

06 May '16

Arch Linux Security Advisory ASA-201605-10 ========================================== Severity: Critical Date : 2016-05-06 CVE-ID : CVE-2016-3105 Package : mercurial Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mercurial before version 3.8.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.8.1-1. # pacman -Syu "mercurial>=3.8.1-1" The problem has been fixed upstream in version 3.8. Workaround ========== None. Description =========== Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This is a further side-effect of Git CVE-2015-7545. Reported and fixed by Blake Burkhart. Impact ====== A remote attacker can execute arbitrary code on the affected host by having a local user convert a crafted git repository. References ========== https://bugs.archlinux.org/task/49239 https://selenic.com/hg/rev/a56296f55a5e https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016… https://access.redhat.com/security/cve/CVE-2016-3105

1 0

[arch-security] [ASA-201605-9] latex2rtf: arbitrary code execution
by Remi Gacogne 06 May '16

06 May '16

Arch Linux Security Advisory ASA-201605-9 ========================================= Severity: High Date : 2016-05-06 CVE-ID : CVE-2015-8106 Package : latex2rtf Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package latex2rtf before version 2.3.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.3.10-1. # pacman -Syu "latex2rtf>=2.3.10-1" The problem has been fixed upstream in version 2.3.10. Workaround ========== None. Description =========== A format string vulnerability was found in the CmdKeywords() function, where the user-controlled variable 'keywords' is passed as a format argument to vnsprintf(), when processing the \keywords command in a TeX file. Impact ====== An attacker can execute arbitrary code on the affected host by supplying a crafted TeX file. References ========== http://www.openwall.com/lists/oss-security/2015/11/16/39 https://access.redhat.com/security/cve/CVE-2015-8106

1 0