June 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201606-25] phpmyadmin: multiple issues
by Jelle van der Waa 26 Jun '16

26 Jun '16

Arch Linux Security Advisory ASA-201606-25 ========================================== Severity: High Date : 2016-06-25 CVE-ID : CVE-2016-5701 CVE-2016-5702 CVE-2016-5703 CVE-2016-5704 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5732 CVE-2016-5732 CVE-2016-5733 CVE-2016-5739 Package : phpmyadmin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package phpmyadmin before version 4.6.3-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 4.6.3-1. # pacman -Syu "phpmyadmin>=4.6.3-1" The problems have been fixed upstream in version 4.6.3. Workaround ========== None. Description =========== - CVE-2016-5702 (cookie attribute injection) A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. Only affected when PHP_SELF is not set. - CVE-2016-5703 (SQL injection) A vulnerability was discovered that allows an SQL injection attack to run arbitrary commands as the control user. This attack requires a controluser to exist and be configured in `config.inc.php`, therefore the attack can be mitigated by temporarily disabling the controluser. - CVE-2016-5704 (cross-side scripting) An cross-side scripting vulnerability was discovered on the table structure page - CVE-2016-5705 (cross-side scripting) * An cross-side scripting vulnerability was discovered on the user privileges page. * An cross-side scripting vulnerability was discovered in the error console. * An cross-side scripting vulnerability was discovered in the central columns feature. * An cross-side scripting vulnerability was discovered in the query bookmarks feature. * An cross-side scripting vulnerability was discovered in the user groups feature. - CVE-2016-5706 (denial of service) A Denial Of Service (DOS) attack was discovered in the way phpMyAdmin loads some JavaScript files. - CVE-2016-5730 (information disclosure) By specially crafting requests in the following areas, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. 1. Setup script 2. Example OpenID authentication script To mitigate these issues, it is possible to remove the setup script and examples subdirectories: ./setup/ and ./examples/. - CVE-2016-5731 (cross-side scripting) With a specially crafted request, it is possible to trigger an cross-side scripting attack through the example OpenID authentication script. Only affected when the default php.ini is changed and set html_errors = Off. - CVE-2016-5732 (cross-side scripting) A vulnerability was reported allowing a specially crafted table parameters to cause an cross-side scripting attack through the table structure page. - CVE-2016-57033 (cross-side scripting) * A vulnerability was reported allowing a specially crafted table name to cause an cross-side scripting attack through the functionality to check database privileges. * This cross-side scripting doesn't exist in some translations due to different quotes being used there (eg. Czech). * A vulnerability was reported allowing a specifically-configured MySQL server to execute an cross-side scripting attack. This particular attack requires configuring the MySQL server log_bin directive with the payload. * Several cross-side scripting vulnerabilities were found with the Transformation feature * Several cross-side scripting vulnerabilities were found in AJAX error handling * Several cross-side scripting vulnerabilities were found in the Designer feature * An cross-side scripting vulnerability was found in the charts feature * An cross-side scripting vulnerability was found in the zoom search feature - CVE-2016-5739 (information disclosure) A vulnerability was reported where a specially crafted Transformation could be used to leak information including the authentication token. This could be used to direct a CSRF attack against a user. Impact ====== A remote attacker might be able to access sensitive information, cause a denial of service, cause a cross-side scripting attack or cause an SQL injection. References ========== https://access.redhat.com/security/cve/CVE-2016-5701 https://access.redhat.com/security/cve/CVE-2016-5702 https://access.redhat.com/security/cve/CVE-2016-5703 https://access.redhat.com/security/cve/CVE-2016-5704 https://access.redhat.com/security/cve/CVE-2016-5705 https://access.redhat.com/security/cve/CVE-2016-5706 https://access.redhat.com/security/cve/CVE-2016-5730 https://access.redhat.com/security/cve/CVE-2016-5731 https://access.redhat.com/security/cve/CVE-2016-5732 https://access.redhat.com/security/cve/CVE-2016-5733 https://access.redhat.com/security/cve/CVE-2016-5739 https://www.phpmyadmin.net/security/PMASA-2016-17/ https://www.phpmyadmin.net/security/PMASA-2016-18/ https://www.phpmyadmin.net/security/PMASA-2016-19/ https://www.phpmyadmin.net/security/PMASA-2016-20/ https://www.phpmyadmin.net/security/PMASA-2016-21/ https://www.phpmyadmin.net/security/PMASA-2016-22/ https://www.phpmyadmin.net/security/PMASA-2016-23/ https://www.phpmyadmin.net/security/PMASA-2016-24/ https://www.phpmyadmin.net/security/PMASA-2016-25/ https://www.phpmyadmin.net/security/PMASA-2016-26/ https://www.phpmyadmin.net/security/PMASA-2016-27/ https://www.phpmyadmin.net/security/PMASA-2016-28/

1 0

[arch-security] [ASA-201606-24] libpurple: multiple issues
by Remi Gacogne 26 Jun '16

26 Jun '16

Arch Linux Security Advisory ASA-201606-24 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323 Package : libpurple Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpurple before version 2.11.0-1 is vulnerable to multiple issues including information leakage, denial of service, directory traversal and arbitrary code execution. Resolution ========== Upgrade to 2.11.0-1. # pacman -Syu "libpurple>=2.11.0-1" The problems have been fixed upstream in version 2.11.0. Workaround ========== All flaws have been found in the support for the MXit protocol. Therefore libpurple is only vulnerable when this protocol is used, so disabling MXit accounts until the package can be upgraded should be enough. Description =========== - CVE-2016-2365 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. - CVE-2016-2366 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2367 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out of bounds read. This issue can also potentially leak sensitive information from memory into the data after the avatar which can then be transferred when the avatar is copied. - CVE-2016-2368 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The MXIT plugin for Pidgin uses the function g_snprintf() in about 27 places where it receives the return value of the function. When g_snprintf() returns, it will return the number of bytes that would have been written had the buffer been large enough, not the amount of bytes that have actually been written. The MXIT plugin uses the return value of g_snprintf() as an index or an offset into the string that is being manipulated in multiple locations without making sure that the return value is within bounds. - CVE-2016-2369 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a NULL pointer dereference. - CVE-2016-2370 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2371 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The function mxit_parse_cmd_extprofile() is called when extended profile packets are received from the server. A malicious server, an attacker who intercepts the network traffic or a potentially malicious user (if the data is not validated by the server) can send an invalid number of records, which could result in an out-of-bounds write of data. - CVE-2016-2372 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. This issue can also potentially leak sensitive information by appending sensitive information from memory to the end of a received file. - CVE-2016-2373 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability. - CVE-2016-2374 (arbitrary code execution) Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution. - CVE-2016-2375 (information leakage) Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. In the function mxit_parse_cmd_suggestcontacts() in the file mxit/protocol.c at line 2020 the number of attributes will be read from the incoming packet into the variable count. - CVE-2016-2376 (arbitrary code execution) Specially crafted MXIT data sent from the server could potentially result in a buffer overflow. The function mxit_cb_rx in the file mxit/protocol.c is a callback function will be called by Pidgin whenever data is sent from the MXIT server. When data is received, the size of the incoming packet will also be received at line 2825. There is a check at line 2826 to ensure that this data isn't larger than the maximum size of that an MXIT packet can be which is defined as CP_MAX_PACKET. This is also the size of the buffer that the data is read into. However if the size is larger than CP_MAX_PACKET, an error will be logged but execution will simply continue. Moreover, if the size is negative (this is possible since rx_res is an int) then no error will be logged and execution will also continue. - CVE-2016-2377 (arbitrary code execution) Specially crafted MXIT data sent by the server could potentially result in an out of bounds write of one byte. - CVE-2016-2378 (arbitrary code execution) Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. - CVE-2016-2380 (information leakage) Specially crafted MXIT data sent to the server could potentially result in an out of bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. - CVE-2016-4323 (directory traversal) Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability. Impact ====== A remote attacker might be able to access sensitive information, cause a denial of service or execute arbitrary code on the affected host. References ========== http://blog.talosintel.com/2016/06/vulnerability-spotlight-pidgin.html https://access.redhat.com/security/cve/CVE-2016-2365 https://access.redhat.com/security/cve/CVE-2016-2366 https://access.redhat.com/security/cve/CVE-2016-2367 https://access.redhat.com/security/cve/CVE-2016-2368 https://access.redhat.com/security/cve/CVE-2016-2369 https://access.redhat.com/security/cve/CVE-2016-2370 https://access.redhat.com/security/cve/CVE-2016-2371 https://access.redhat.com/security/cve/CVE-2016-2372 https://access.redhat.com/security/cve/CVE-2016-2373 https://access.redhat.com/security/cve/CVE-2016-2374 https://access.redhat.com/security/cve/CVE-2016-2375 https://access.redhat.com/security/cve/CVE-2016-2376 https://access.redhat.com/security/cve/CVE-2016-2377 https://access.redhat.com/security/cve/CVE-2016-2378 https://access.redhat.com/security/cve/CVE-2016-2380 https://access.redhat.com/security/cve/CVE-2016-4323

1 0

[arch-security] [ASA-201606-23] libdwarf: arbitrary code execution
by Remi Gacogne 26 Jun '16

26 Jun '16

Arch Linux Security Advisory ASA-201606-23 ========================================== Severity: High Date : 2016-06-25 CVE-ID : CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5034 CVE-2016-5035 CVE-2016-5036 CVE-2016-5037 CVE-2016-5038 CVE-2016-5039 CVE-2016-5040 CVE-2016-5041 CVE-2016-5042 CVE-2016-5043 CVE-2016-5044 Package : libdwarf Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libdwarf before version 20160613-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 20160613-1. # pacman -Syu "libdwarf>=20160613-1" The problems have been fixed upstream in version 20160613. Workaround ========== None. Description =========== - CVE-2016-5027 (denial of service) Multiple NULL pointer dereference issues in several functions of libdwarf/dwarf_leb.c, where leb128_length was wrongly assumed non-NULL. - CVE-2016-5028 (denial of service) NULL pointer dereference issue in print_frame_inst_bytes(). - CVE-2016-5029 (denial of service) NULL pointer dereference issue in create_fullest_file_path(). - CVE-2016-5030 (denial of service) NULL pointer dereference issue in _dwarf_calculate_info_section_end_ptr(). - CVE-2016-5031 (denial of service) Out-of-bounds read bug in print_frame_inst_bytes(). - CVE-2016-5032 (denial of service) Out-of-bounds read bug in dwarf_get_xu_hash_entry(). - CVE-2016-5033 (denial of service) Out-of-bounds read bug in print_exprloc_content(). - CVE-2016-5034 (arbitrary code execution) Invalid write in dwarf_elf_access.c. - CVE-2016-5035 (denial of service) Out-of-bounds read bug in _dwarf_read_line_table_header(). - CVE-2016-5036 (denial of service) Out-of-bounds read bug in dump_block(). - CVE-2016-5037 (denial of service) NULL pointer dereference issue in _dwarf_load_section(). - CVE-2016-5038 (denial of service) NULL pointer dereference issue in dwarf_get_macro_startend_file(). - CVE-2016-5039 (denial of service) Out-of-bounds read bug in get_attr_value(). - CVE-2016-5040 (denial of service) Out-of-bounds read bug. - CVE-2016-5041 (denial of service) NULL pointer dereference issue. - CVE-2016-5042 (denial of service) Infinite loop leading to out-of-bounds read in dwarf_get_aranges_list(). - CVE-2016-5043 (denial of service) Out-of-bounds read bug in dwarf_dealloc(). - CVE-2016-5044 (arbitrary code execution) Heap-overflow. Impact ====== An attacker might be able to execute arbitrary code on the affected host with a crafted ELF file, or crafted dwarf sections in a object file. References ========== http://seclists.org/oss-sec/2016/q2/393 https://www.prevanders.net/dwarfbug.html https://access.redhat.com/security/cve/CVE-2016-5027 https://access.redhat.com/security/cve/CVE-2016-5028 https://access.redhat.com/security/cve/CVE-2016-5029 https://access.redhat.com/security/cve/CVE-2016-5030 https://access.redhat.com/security/cve/CVE-2016-5031 https://access.redhat.com/security/cve/CVE-2016-5032 https://access.redhat.com/security/cve/CVE-2016-5033 https://access.redhat.com/security/cve/CVE-2016-5034 https://access.redhat.com/security/cve/CVE-2016-5035 https://access.redhat.com/security/cve/CVE-2016-5036 https://access.redhat.com/security/cve/CVE-2016-5037 https://access.redhat.com/security/cve/CVE-2016-5038 https://access.redhat.com/security/cve/CVE-2016-5039 https://access.redhat.com/security/cve/CVE-2016-5040 https://access.redhat.com/security/cve/CVE-2016-5041 https://access.redhat.com/security/cve/CVE-2016-5042 https://access.redhat.com/security/cve/CVE-2016-5043 https://access.redhat.com/security/cve/CVE-2016-5044

1 0

[arch-security] [ASA-201606-22] xerces-c: arbitrary code execution
by Remi Gacogne 26 Jun '16

26 Jun '16

Arch Linux Security Advisory ASA-201606-22 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2099 Package : xerces-c Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xerces-c before version 3.1.3-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.1.3-2. # pacman -Syu "xerces-c>=3.1.3-2" The problem has been fixed upstream in version 3.1.3. Workaround ========== None. Description =========== The DTDScanner fails to account for the fact that peeking characters in the XMLReader class can raise an exception if an invalid character is encountered, and the exception crosses stack frames in an unsafe way that causes a higher level exception handler to access an already-freed object. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host by submitting a crafted DTD file. References ========== https://bugs.archlinux.org/task/49353 https://issues.apache.org/jira/browse/XERCESC-2066 http://www.openwall.com/lists/oss-security/2016/05/09/7 https://access.redhat.com/security/cve/CVE-2016-2099

1 0

[arch-security] [ASA-201606-21] vlc: arbitrary code execution
by Remi Gacogne 26 Jun '16

26 Jun '16

Arch Linux Security Advisory ASA-201606-21 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-5108 Package : vlc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package vlc before version 2.2.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.2.4-1. # pacman -Syu "vlc>=2.2.4-1" The problem has been fixed upstream in version 2.2.4. Workaround ========== None. Description =========== A buffer overflow has been found in the DecodeAdpcmImaQT() function of VLC's QuickTime IMA decoder. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host via a crafted QuickTime IMA file. References ========== http://www.openwall.com/lists/oss-security/2016/05/27/7 https://access.redhat.com/security/cve/CVE-2016-5108

1 0

[arch-security] [ASA-201606-20] chromium: arbitrary code execution
by Remi Gacogne 26 Jun '16

26 Jun '16

Arch Linux Security Advisory ASA-201606-20 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-1704 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 51.0.2704.103-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 51.0.2704.103-1. # pacman -Syu "chromium>=51.0.2704.103-1" The problem has been fixed upstream in version 51.0.2704.103. Workaround ========== None. Description =========== Various fixes from internal audits, fuzzing and other initiatives, including multiple issues in the processing of malformed web content. Impact ====== A remote attacker might be able to cause a denial of service, access sensitive information or execute arbitrary code on the affected host via a specially crafted web page. References ========== https://googlechromereleases.blogspot.fr/2016/06/stable-channel-update_16.h… https://access.redhat.com/security/cve/CVE-2016-1704

1 0

[arch-security] [ASA-201606-19] wget: arbitrary file overwrite
by Levente Polyak 20 Jun '16

20 Jun '16

Arch Linux Security Advisory ASA-201606-19 ========================================== Severity: High Date : 2016-06-20 CVE-ID : CVE-2016-4971 Package : wget Type : arbitrary file overwrite Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wget before version 1.18-1 is vulnerable to arbitrary file overwrite that could lead to potential code execution. Resolution ========== Upgrade to 1.18-1. # pacman -Syu "wget>=1.18-1" The problem has been fixed upstream in version 1.18. Workaround ========== None. Description =========== GNU Wget when supplied with a malicious website link can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary content and filename under the current directory. This can lead to potential code execution by creating system scripts (such as .bash_profile and others) within home directory as well as other unauthorized actions (such as request sniffing by proxy modification, or arbitrary system file retrieval) by uploading .wgetrc configuration file. Because of this vulnerability, an attacker is able to overwrite an arbitrary file in the victim's current directory. Impact ====== A remote attacker is able to overwrite an arbitrary file in the victim's current directory that could potentially lead to code execution by creating system scripts that are executed. References ========== https://access.redhat.com/security/cve/CVE-2016-4971 https://lists.gnu.org/archive/html/bug-wget/2016-06/msg00033.html https://bugs.archlinux.org/task/49730

1 0

[arch-security] [ASA-201606-18] lib32-flashplugin: multiple issues
by Levente Polyak 20 Jun '16

20 Jun '16

Arch Linux Security Advisory ASA-201606-18 ========================================== Severity: Critical Date : 2016-06-20 CVE-ID : CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.626-1 is vulnerable to multiple issues including same-origin policy bypass and arbitrary code execution. Resolution ========== Upgrade to 11.2.202.626-1. # pacman -Syu "lib32-flashplugin>=11.2.202.626-1" The problems have been fixed upstream in version 11.2.202.626. Workaround ========== None. Description =========== - CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 (arbitrary code execution) Memory corruptions leading to arbitrary code execution. - CVE-2016-4135, CVE-2016-4136, CVE-2016-4138 (arbitrary code execution) Heap-based buffer overflows leading to arbitrary code execution. - CVE-2016-4139 (information leak) Vulnerability that could be exploited to bypass the same-origin policy and lead to information disclosure. - CVE-2016-4140 (arbitrary code execution) Vulnerability in the directory search path used to find resources that could lead to code execution. - CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148 (arbitrary code execution) Use-after-free vulnerabilities leading to arbitrary code execution. - CVE-2016-4144, CVE-2016-4149 (arbitrary code execution) Type confusion vulnerabilities leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code by using a crafted flash application. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://access.redhat.com/security/cve/CVE-2016-4122 https://access.redhat.com/security/cve/CVE-2016-4123 https://access.redhat.com/security/cve/CVE-2016-4124 https://access.redhat.com/security/cve/CVE-2016-4125 https://access.redhat.com/security/cve/CVE-2016-4127 https://access.redhat.com/security/cve/CVE-2016-4128 https://access.redhat.com/security/cve/CVE-2016-4129 https://access.redhat.com/security/cve/CVE-2016-4130 https://access.redhat.com/security/cve/CVE-2016-4131 https://access.redhat.com/security/cve/CVE-2016-4132 https://access.redhat.com/security/cve/CVE-2016-4133 https://access.redhat.com/security/cve/CVE-2016-4134 https://access.redhat.com/security/cve/CVE-2016-4135 https://access.redhat.com/security/cve/CVE-2016-4136 https://access.redhat.com/security/cve/CVE-2016-4137 https://access.redhat.com/security/cve/CVE-2016-4138 https://access.redhat.com/security/cve/CVE-2016-4139 https://access.redhat.com/security/cve/CVE-2016-4140 https://access.redhat.com/security/cve/CVE-2016-4141 https://access.redhat.com/security/cve/CVE-2016-4142 https://access.redhat.com/security/cve/CVE-2016-4143 https://access.redhat.com/security/cve/CVE-2016-4144 https://access.redhat.com/security/cve/CVE-2016-4145 https://access.redhat.com/security/cve/CVE-2016-4146 https://access.redhat.com/security/cve/CVE-2016-4147 https://access.redhat.com/security/cve/CVE-2016-4148 https://access.redhat.com/security/cve/CVE-2016-4149 https://access.redhat.com/security/cve/CVE-2016-4150 https://access.redhat.com/security/cve/CVE-2016-4151 https://access.redhat.com/security/cve/CVE-2016-4152 https://access.redhat.com/security/cve/CVE-2016-4153 https://access.redhat.com/security/cve/CVE-2016-4154 https://access.redhat.com/security/cve/CVE-2016-4155 https://access.redhat.com/security/cve/CVE-2016-4156 https://access.redhat.com/security/cve/CVE-2016-4166 https://access.redhat.com/security/cve/CVE-2016-4171

1 0

[arch-security] [ASA-201606-17] lib32-glibc: denial of service
by Levente Polyak 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-17 ========================================== Severity: Medium Date : 2016-06-19 CVE-ID : CVE-2016-4429 Package : lib32-glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.23-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.23-5. # pacman -Syu "lib32-glibc>=2.23-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Impact ====== A remote attacker is able to send specially crafted ICMP and UDP packets that are leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-4429 https://sourceware.org/bugzilla/show_bug.cgi?id=20112

1 0

[arch-security] [ASA-201606-16] glibc: denial of service
by Levente Polyak 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-16 ========================================== Severity: Medium Date : 2016-06-19 CVE-ID : CVE-2016-4429 Package : glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.23-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.23-5. # pacman -Syu "glibc>=2.23-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Impact ====== A remote attacker is able to send specially crafted ICMP and UDP packets that are leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-4429 https://sourceware.org/bugzilla/show_bug.cgi?id=20112

1 0