May 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201605-8] gd: arbitrary code execution
by Remi Gacogne 06 May '16

06 May '16

Arch Linux Security Advisory ASA-201605-8 ========================================= Severity: Critical Date : 2016-05-06 CVE-ID : CVE-2016-3074 Package : gd Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gd before version 2.1.1-4 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.1.1-4. # pacman -Syu "gd>=2.1.1-4" The problem has been fixed upstream, but a version including the fix has not been released yet. Workaround ========== None. Description =========== A heap-based buffer overflow caused by an integer signedness error has been found in the libgd code handling compressed gd2 chunks. Impact ====== A remote attacker can cause a denial of service or execute arbitrary code on the affected host by submitting a crafted image file. References ========== http://seclists.org/oss-sec/2016/q2/128 https://github.com/libgd/libgd/commit/2bb97f407c1145c850416a3bfbcc8cf124e68… https://access.redhat.com/security/cve/CVE-2016-3074

1 0

[arch-security] [ASA-201605-7] chromium: multiple issues
by Remi Gacogne 05 May '16

05 May '16

Arch Linux Security Advisory ASA-201605-7 ========================================= Severity: High Date : 2016-05-05 CVE-ID : CVE-2016-1660 CVE-2016-1661 CVE-2016-1662 CVE-2016-1663 CVE-2016-1664 CVE-2016-1665 CVE-2016-1666 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 50.0.2661.94-1 is vulnerable to multiple issues leading to denial of service, information leakage or arbitrary code execution. Resolution ========== Upgrade to 50.0.2661.94-1. # pacman -Syu "chromium>=50.0.2661.94-1" The problems have been fixed upstream in version 50.0.2661.94. Workaround ========== None. Description =========== - CVE-2016-1660: Out-of-bounds write in Blink. Credit to Atte Kettunen of OUSPG. - CVE-2016-1661: Memory corruption in cross-process frames. Credit to Wadih Matar. - CVE-2016-1662: Use-after-free in extensions. Credit to Rob Wu. - CVE-2016-1663: Use-after-free in Blink's V8 bindings. Credit to anonymous. - CVE-2016-1664: Address bar spoofing. Credit to Wadih Matar. - CVE-2016-1665: Information leak in V8. Credit to HyungSeok Han. - CVE-2016-1666: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can cause a denial of service, access sensitive information or possibly execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/04/stable-channel-update_28.ht… https://access.redhat.com/security/cve/CVE-2016-1660 https://access.redhat.com/security/cve/CVE-2016-1661 https://access.redhat.com/security/cve/CVE-2016-1662 https://access.redhat.com/security/cve/CVE-2016-1663 https://access.redhat.com/security/cve/CVE-2016-1664 https://access.redhat.com/security/cve/CVE-2016-1665 https://access.redhat.com/security/cve/CVE-2016-1666

1 0

[arch-security] [ASA-201605-6] imagemagick: arbitrary code execution
by Levente Polyak 05 May '16

05 May '16

Arch Linux Security Advisory ASA-201605-6 ========================================= Severity: Critical Date : 2016-05-05 CVE-ID : CVE-2016-3714 Package : imagemagick Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.3.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 6.9.3.10-1. # pacman -Syu "imagemagick>=6.9.3.10-1" The problem has been fixed upstream in version 6.9.3.10. Workaround ========== To prevent these possible exploits, simply add <policy domain="coder" rights="none" pattern="EPHEMERAL" /> <policy domain="coder" rights="none" pattern="HTTPS" /> <policy domain="coder" rights="none" pattern="MVG" /> <policy domain="coder" rights="none" pattern="MSL" /> <policy domain="coder" rights="none" pattern="TEXT" /> <policy domain="coder" rights="none" pattern="SHOW" /> <policy domain="coder" rights="none" pattern="WIN" /> <policy domain="coder" rights="none" pattern="PLT" /> to your policy.xml file. To mitigate the dangerous HTTPS delegate, you can also remove support for it by deleting it from the delegates.xml configuration file. Description =========== It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application. Impact ====== A remote attacker is able to use a specially crafted image file that, when processed, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-3714 https://bugs.archlinux.org/task/49203 https://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 https://imagetragick.com/

1 0

[arch-security] [ASA-201605-5] quassel-core: denial of service
by Christian Rebischke 05 May '16

05 May '16

Arch Linux Security Advisory ASA-201605-5 ========================================= Severity: Medium Date : 2016-05-05 CVE-ID : CVE-2016-4414 Package : quassel-core Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package quassel-core before version 0.12.4-1 is vulnerable to denial of service attack by unauthenticated clients. Resolution ========== Upgrade to 0.12.4-1. # pacman -Syu "quassel-core>=0.12.4-1" The problem has been fixed upstream in version 0.12.4. Workaround ========== None. Description =========== - CVE-2016-4414 (denial of service) It was found that quasselcore is vulnerable to a denial of service attack by unauthenticated clients. The protocol negotiation did not take into account lack of a match, in which case PeerFactory::createPeer returns a nullptr, which is immediately dereferenced. Impact ====== A remote attacker is able to crash the quassel-core with an unauthenticated client. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4414 https://marc.info/?l=oss-security&m=146204310020229&w=2 https://github.com/quassel/quassel/commit/e67887343c433cc35bc26ad6a9392588f…

1 0

[arch-security] [ASA-201605-4] lib32-openssl: multiple issues
by Remi Gacogne 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-4 ========================================= Severity: High Date : 2016-05-04 CVE-ID : CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-openssl before version 1:1.0.2.h-1 is vulnerable to multiple issues leading to man-in-the-middle or possibly arbitrary code execution. Resolution ========== Upgrade to 1:1.0.2.h-1. # pacman -Syu "lib32-openssl>=1:1.0.2.h-1" The problem has been fixed upstream in version 1.0.2h. Workaround ========== None. Description =========== - CVE-2016-2105 (buffer overflow): An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications. These internal uses are not considered vulnerable because all calls are bounded with length checks so no overflow is possible. User applications that call these APIs directly with large amounts of untrusted data may be vulnerable. (Note: Initial analysis suggested that the PEM_write_bio* were vulnerable, and this is reflected in the patch commit message. This is no longer believed to be the case). - CVE-2016-2106 (buffer overflow): An overflow can occur in the EVP_EncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVP_EncryptUpdate() function all usage is one of two forms. The first form is where the EVP_EncryptUpdate() call is known to be the first called function after an EVP_EncryptInit(), and therefore that specific call must be safe. The second form is where the length passed to EVP_EncryptUpdate() can be seen from the code to be some small value and therefore there is no possibility of an overflow. Since all instances are one of these two forms, it is believed that there can be no overflows in internal code due to this problem. It should be noted that EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths. Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances of these calls have also been analysed too and it is believed there are no instances in internal usage where an overflow could occur. This could still represent a security issue for end user code that calls this function directly. - CVE-2016-2107 (man-in-the-middle): A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. - CVE-2016-2109 (memory exhaustion): When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can cause allocation of large amounts of memory potentially consuming excessive resources or exhausting memory. Any application parsing untrusted data through d2i BIO functions is affected. The memory based functions such as d2i_X509() are *not* affected. Since the memory based functions are used by the TLS library, TLS applications are not affected. - CVE-2016-2176 (information leak): ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Impact ====== A remote attacker might be able to do a man-in-the-middle attack, access sensitive information, cause a crash or execute arbitrary code on the affected host. References ========== https://www.openssl.org/news/secadv/20160503.txt https://access.redhat.com/security/cve/CVE-2016-2105 https://access.redhat.com/security/cve/CVE-2016-2106 https://access.redhat.com/security/cve/CVE-2016-2107 https://access.redhat.com/security/cve/CVE-2016-2109 https://access.redhat.com/security/cve/CVE-2016-2176

1 0

[arch-security] [ASA-201605-3] openssl: multiple issues
by Remi Gacogne 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-3 ========================================= Severity: High Date : 2016-05-04 CVE-ID : CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176 Package : openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.h-1 is vulnerable to multiple issues leading to man-in-the-middle or possibly arbitrary code execution. Resolution ========== Upgrade to 1.0.2.h-1. # pacman -Syu "openssl>=1.0.2.h-1" The problem has been fixed upstream in version 1.0.2.h. Workaround ========== None. Description =========== - CVE-2016-2105 (buffer overflow): An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications. These internal uses are not considered vulnerable because all calls are bounded with length checks so no overflow is possible. User applications that call these APIs directly with large amounts of untrusted data may be vulnerable. (Note: Initial analysis suggested that the PEM_write_bio* were vulnerable, and this is reflected in the patch commit message. This is no longer believed to be the case). - CVE-2016-2106 (buffer overflow): An overflow can occur in the EVP_EncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVP_EncryptUpdate() function all usage is one of two forms. The first form is where the EVP_EncryptUpdate() call is known to be the first called function after an EVP_EncryptInit(), and therefore that specific call must be safe. The second form is where the length passed to EVP_EncryptUpdate() can be seen from the code to be some small value and therefore there is no possibility of an overflow. Since all instances are one of these two forms, it is believed that there can be no overflows in internal code due to this problem. It should be noted that EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths. Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances of these calls have also been analysed too and it is believed there are no instances in internal usage where an overflow could occur. This could still represent a security issue for end user code that calls this function directly. - CVE-2016-2107 (man-in-the-middle): A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes. - CVE-2016-2109 (memory exhaustion): When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can cause allocation of large amounts of memory potentially consuming excessive resources or exhausting memory. Any application parsing untrusted data through d2i BIO functions is affected. The memory based functions such as d2i_X509() are *not* affected. Since the memory based functions are used by the TLS library, TLS applications are not affected. - CVE-2016-2176 (information leak): ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Impact ====== A remote attacker might be able to do a man-in-the-middle attack, access sensitive information, cause a crash or execute arbitrary code on the affected host. References ========== https://www.openssl.org/news/secadv/20160503.txt https://access.redhat.com/security/cve/CVE-2016-2105 https://access.redhat.com/security/cve/CVE-2016-2106 https://access.redhat.com/security/cve/CVE-2016-2107 https://access.redhat.com/security/cve/CVE-2016-2109 https://access.redhat.com/security/cve/CVE-2016-2176

1 0

[arch-security] [ASA-201605-2] jasper: multiple issues
by Levente Polyak 04 May '16

04 May '16

Arch Linux Security Advisory ASA-201605-2 ========================================= Severity: High Date : 2016-05-04 CVE-ID : CVE-2016-1577 CVE-2016-2089 CVE-2016-2116 Package : jasper Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.1-15 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.1-15. # pacman -Syu "jasper>=1.900.1-15" The problems have not been fixed upstream but patches were applied. Workaround ========== None. Description =========== - CVE-2016-1577 (arbitrary code execution) Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file. - CVE-2016-2089 (denial of service) The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. - CVE-2016-2116 (denial of service) Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. Impact ====== A remote attacker is able to use a specially crafted image file that, when processed, is leading to denial of service or arbitrary code execution. References ========== https://bugs.archlinux.org/task/48511 https://access.redhat.com/security/cve/CVE-2016-1577 https://access.redhat.com/security/cve/CVE-2016-2089 https://access.redhat.com/security/cve/CVE-2016-2116

1 0

[arch-security] [ASA-201605-1] imlib2: multiple issues
by Levente Polyak 03 May '16

03 May '16

Arch Linux Security Advisory ASA-201605-1 ========================================= Severity: High Date : 2016-05-01 CVE-ID : CVE-2011-5326 CVE-2016-3993 CVE-2016-3994 CVE-2016-4024 Package : imlib2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imlib2 before version 1.4.9-1 is vulnerable to multiple issues that can lead to information leakage, application crash or arbitrary code execution. Resolution ========== Upgrade to 1.4.9-1. # pacman -Syu "imlib2>=1.4.9-1" The problems have been fixed upstream in version 1.4.9. Workaround ========== None. Description =========== - CVE-2011-5326 (denial of service) Kevin Ryde discovered that attempting to draw a 2x1 radi ellipse results in a floating point exception. - CVE-2016-3993 (information leakage) Yuriy M. Kaminskiy discovered that drawing using coordinates from an untrusted source could lead to an out-of-bound memory read, which in turn could result in an application crash. - CVE-2016-3994 (information Leakage) Jakub Wilk discovered that a malformed image could lead to an out-of-bound read in the GIF loader, which may result in an application crash or information leak. - CVE-2016-4024 (arbitrary code execution) Yuriy M. Kaminskiy discovered an integer overflow that could lead to an insufficient heap allocation and out-of-bound memory write. Impact ====== An attacker can leverage vulnerable library calls in imlib2 to crash an application, or read/write to the application's memory. This can lead to potential information leak or modification of the application's flow. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5326 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3993 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3994 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4021 http://article.gmane.org/gmane.comp.window-managers.enlightenment.devel/643… http://article.gmane.org/gmane.comp.security.oss.general/19276

1 0