June 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201606-15] flashplugin: multiple issues
by Remi Gacogne 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-15 ========================================== Severity: Critical Date : 2016-06-19 CVE-ID : CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.626-1 is vulnerable to multiple issues including same-origin policy bypass and arbitrary code execution. Resolution ========== Upgrade to 11.2.202.626-1. # pacman -Syu "flashplugin>=11.2.202.626-1" The problems have been fixed upstream in version 11.2.202.626. Workaround ========== None. Description =========== - CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 (arbitrary code execution) Memory corruptions leading to arbitrary code execution. - CVE-2016-4135, CVE-2016-4136, CVE-2016-4138 (arbitrary code execution) Heap-based buffer overflows leading to arbitrary code execution. - CVE-2016-4139 (information leak) Vulnerability that could be exploited to bypass the same-origin policy and lead to information disclosure. - CVE-2016-4140 (arbitrary code execution) Vulnerability in the directory search path used to find resources that could lead to code execution. - CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148 (arbitrary code execution) Use-after-free vulnerabilities leading to arbitrary code execution. - CVE-2016-4144, CVE-2016-4149 (arbitrary code execution) Type confusion vulnerabilities leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code by using a crafted flash application. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://access.redhat.com/security/cve/CVE-2016-4122 https://access.redhat.com/security/cve/CVE-2016-4123 https://access.redhat.com/security/cve/CVE-2016-4124 https://access.redhat.com/security/cve/CVE-2016-4125 https://access.redhat.com/security/cve/CVE-2016-4127 https://access.redhat.com/security/cve/CVE-2016-4128 https://access.redhat.com/security/cve/CVE-2016-4129 https://access.redhat.com/security/cve/CVE-2016-4130 https://access.redhat.com/security/cve/CVE-2016-4131 https://access.redhat.com/security/cve/CVE-2016-4132 https://access.redhat.com/security/cve/CVE-2016-4133 https://access.redhat.com/security/cve/CVE-2016-4134 https://access.redhat.com/security/cve/CVE-2016-4135 https://access.redhat.com/security/cve/CVE-2016-4136 https://access.redhat.com/security/cve/CVE-2016-4137 https://access.redhat.com/security/cve/CVE-2016-4138 https://access.redhat.com/security/cve/CVE-2016-4139 https://access.redhat.com/security/cve/CVE-2016-4140 https://access.redhat.com/security/cve/CVE-2016-4141 https://access.redhat.com/security/cve/CVE-2016-4142 https://access.redhat.com/security/cve/CVE-2016-4143 https://access.redhat.com/security/cve/CVE-2016-4144 https://access.redhat.com/security/cve/CVE-2016-4145 https://access.redhat.com/security/cve/CVE-2016-4146 https://access.redhat.com/security/cve/CVE-2016-4147 https://access.redhat.com/security/cve/CVE-2016-4148 https://access.redhat.com/security/cve/CVE-2016-4149 https://access.redhat.com/security/cve/CVE-2016-4150 https://access.redhat.com/security/cve/CVE-2016-4151 https://access.redhat.com/security/cve/CVE-2016-4152 https://access.redhat.com/security/cve/CVE-2016-4153 https://access.redhat.com/security/cve/CVE-2016-4154 https://access.redhat.com/security/cve/CVE-2016-4155 https://access.redhat.com/security/cve/CVE-2016-4156 https://access.redhat.com/security/cve/CVE-2016-4166 https://access.redhat.com/security/cve/CVE-2016-4171

1 0

[arch-security] [ASA-201606-14] lib32-expat: multiple issues
by Levente Polyak 12 Jun '16

12 Jun '16

Arch Linux Security Advisory ASA-201606-14 ========================================== Severity: Medium Date : 2016-06-13 CVE-ID : CVE-2012-6702 CVE-2016-5300 Package : lib32-expat Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-expat before version 2.1.1-3 is vulnerable to multiple issues including predictable random numbers and insufficient hash entropy leading to denial of service. Resolution ========== Upgrade to 2.1.1-3. # pacman -Syu "lib32-expat>=2.1.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-6702 (predictable random numbers) It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 (denial of service) It was found that original fix for CVE-2012-0876 used too little entropy for the hash initialization. This issue can be used to perform a hash collision based denial of service attack. Impact ====== A remote attacker is able to predict random numbers from the PRNG or perform a hash based collision attack resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2012-6702 https://access.redhat.com/security/cve/CVE-2016-5300

1 0

[arch-security] [ASA-201606-13] expat: multiple issues
by Levente Polyak 12 Jun '16

12 Jun '16

Arch Linux Security Advisory ASA-201606-13 ========================================== Severity: Medium Date : 2016-06-13 CVE-ID : CVE-2012-6702 CVE-2016-5300 Package : expat Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package expat before version 2.1.1-3 is vulnerable to multiple issues including predictable random numbers and insufficient hash entropy leading to denial of service. Resolution ========== Upgrade to 2.1.1-3. # pacman -Syu "expat>=2.1.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-6702 (predictable random numbers) It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 (denial of service) It was found that original fix for CVE-2012-0876 used too little entropy for the hash initialization. This issue can be used to perform a hash collision based denial of service attack. Impact ====== A remote attacker is able to predict random numbers from the PRNG or perform a hash based collision attack resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2012-6702 https://access.redhat.com/security/cve/CVE-2016-5300

1 0

[arch-security] [ASA-201606-12] lib32-gnutls: arbitrary file overwrite
by Levente Polyak 10 Jun '16

10 Jun '16

Arch Linux Security Advisory ASA-201606-12 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-4456 Package : lib32-gnutls Type : arbitrary file overwrite Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-gnutls before version 3.4.13-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 3.4.13-1. # pacman -Syu "lib32-gnutls>=3.4.13-1" The problem has been fixed upstream in version 3.4.13. Workaround ========== None. Description =========== Setuid programs using GnuTLS could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 with the GNUTLS_KEYLOGFILE environment variable handling via getenv() and fixed in GnuTLS 3.4.13 by switching to secure_getenv() where available. Impact ====== A local attacker is able to overwrite arbitrary files with a setuid program using GnuTLS by setting the GNUTLS_KEYLOGFILE environment variable. References ========== https://access.redhat.com/security/cve/CVE-2016-4456 http://gnutls.org/security.html#GNUTLS-SA-2016-1

1 0

[arch-security] [ASA-201606-11] haproxy: denial of service
by Levente Polyak 10 Jun '16

10 Jun '16

Arch Linux Security Advisory ASA-201606-11 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-5360 Package : haproxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package haproxy before version 1.6.5-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.5-4. # pacman -Syu "haproxy>=1.6.5-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A problem has been discovered with the new field "rule_deny_status" into struct http_txn, which is filled only by actions "http-request deny" and "http-request tarpit". It's then used in the deny code path to emit the proper error message, but is used uninitialized when the deny comes from a "reqdeny" rule, causing random behaviours ranging from returning a 200, an empty response, or crashing the process. Impact ====== A remote attacker is able to use a specially crafted request to crash the process resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-5360 http://www.openwall.com/lists/oss-security/2016/06/09/5 https://bugs.archlinux.org/task/49638

1 0

[arch-security] [ASA-201606-10] gnutls: arbitrary file overwrite
by Levente Polyak 10 Jun '16

10 Jun '16

Arch Linux Security Advisory ASA-201606-10 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-4456 Package : gnutls Type : arbitrary file overwrite Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gnutls before version 3.4.13-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 3.4.13-1. # pacman -Syu "gnutls>=3.4.13-1" The problem has been fixed upstream in version 3.4.13. Workaround ========== None. Description =========== Setuid programs using GnuTLS could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 with the GNUTLS_KEYLOGFILE environment variable handling via getenv() and fixed in GnuTLS 3.4.13 by switching to secure_getenv() where available. Impact ====== A local attacker is able to overwrite arbitrary files with a setuid program using GnuTLS by setting the GNUTLS_KEYLOGFILE environment variable. References ========== https://access.redhat.com/security/cve/CVE-2016-4456 http://gnutls.org/security.html#GNUTLS-SA-2016-1

1 0

[arch-security] [ASA-201606-9] qemu-arch-extra: multiple issues
by Christian Rebischke 08 Jun '16

08 Jun '16

Arch Linux Security Advisory ASA-201606-8 ========================================= Severity: Critical Date : 2016-06-08 CVE-ID : CVE-2015-8558 CVE-2016-3710 CVE-2016-3712 CVE-2016-5105 CVE-2016-5106 CVE-2016-5107 Package : qemu-arch-extra Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu-arch-extra before version 2.6.0-1 is vulnerable to multiple issues including denial of service and arbitrary code execution. Resolution ========== Upgrade to 2.6.0-1. # pacman -Syu "qemu-arch-extra>=2.6.0-1" The problems have been fixed upstream in version 2.6.0. Workaround ========== None. Description =========== - CVE-2015-8558 (denial of service) An infinite-loop issue was found in the QEMU emulator built with USB EHCI emulation support. The flaw occurred during communication between the host controller interface(EHCI) and a respective device driver. These two communicate using an isochronous transfer descriptor list(iTD); an infinite loop unfolded if there was a closed loop in the list. A privileged user inside a guest could use this flaw to consume excessive resources and cause denial of service. - CVE-2016-3710 (arbitrary code execution) An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process. - CVE-2016-3712 (denial of service) Qemu emulator built with the VGA Emulator support is vulnerable to an integer overflow and OOB read access issues. This occurs because Qemu allows certain VGA registers to be set while in VBE mode. A privileged guest user could use this flaw to crash the Qemu process instance resulting in DoS. - CVE-2016-5105 (information leakage) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an information leakage issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to read device configuration in 'megasas_dcmd_cfg_read'. A privileged user inside guest could use this flaw to leak host memory bytes. - CVE-2016-5106 (denial of service) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an out-of-bounds write access issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to set controller properties in 'megasas_dcmd_set_properties'. A privileged user inside guest could use this flaw to crash the Qemu process on the host resulting in DoS. - CVE-2016-5107 (denial of service) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an out-of-bounds read access issue. It could occur while looking up MegaRAID Firmware Interface(MFI) command frames in 'megasas_lookup_frame' routine. A privileged user inside guest could use this flaw to read invalid memory leading to crash the Qemu process on the host. Impact ====== An attacker inside of the guest system is able to cause excessive resource consumption, crash the qemu process, execute arbitrary code on the host system and leak information from the host system. References ========== https://access.redhat.com/security/cve/CVE-2015-8558 https://access.redhat.com/security/cve/CVE-2016-3710 https://access.redhat.com/security/cve/CVE-2016-3712 https://access.redhat.com/security/cve/CVE-2016-5105 https://access.redhat.com/security/cve/CVE-2016-5106 https://access.redhat.com/security/cve/CVE-2016-5107

1 0

[arch-security] [ASA-201606-8] qemu: multiple issues
by Christian Rebischke 08 Jun '16

08 Jun '16

Arch Linux Security Advisory ASA-201606-8 ========================================= Severity: Critical Date : 2016-06-08 CVE-ID : CVE-2015-8558 CVE-2016-3710 CVE-2016-3712 CVE-2016-5105 CVE-2016-5106 CVE-2016-5107 Package : qemu Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.6.0-1 is vulnerable to multiple issues including denial of service and arbitrary code execution. Resolution ========== Upgrade to 2.6.0-1. # pacman -Syu "qemu>=2.6.0-1" The problems have been fixed upstream in version 2.6.0. Workaround ========== None. Description =========== - CVE-2015-8558 (denial of service) An infinite-loop issue was found in the QEMU emulator built with USB EHCI emulation support. The flaw occurred during communication between the host controller interface(EHCI) and a respective device driver. These two communicate using an isochronous transfer descriptor list(iTD); an infinite loop unfolded if there was a closed loop in the list. A privileged user inside a guest could use this flaw to consume excessive resources and cause denial of service. - CVE-2016-3710 (arbitrary code execution) An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process. - CVE-2016-3712 (denial of service) Qemu emulator built with the VGA Emulator support is vulnerable to an integer overflow and OOB read access issues. This occurs because Qemu allows certain VGA registers to be set while in VBE mode. A privileged guest user could use this flaw to crash the Qemu process instance resulting in DoS. - CVE-2016-5105 (information leakage) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an information leakage issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to read device configuration in 'megasas_dcmd_cfg_read'. A privileged user inside guest could use this flaw to leak host memory bytes. - CVE-2016-5106 (denial of service) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an out-of-bounds write access issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to set controller properties in 'megasas_dcmd_set_properties'. A privileged user inside guest could use this flaw to crash the Qemu process on the host resulting in DoS. - CVE-2016-5107 (denial of service) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an out-of-bounds read access issue. It could occur while looking up MegaRAID Firmware Interface(MFI) command frames in 'megasas_lookup_frame' routine. A privileged user inside guest could use this flaw to read invalid memory leading to crash the Qemu process on the host. Impact ====== An attacker inside of the guest system is able to cause excessive resource consumption, crash the qemu process, execute arbitrary code on the host system and leak information from the host system. References ========== https://access.redhat.com/security/cve/CVE-2015-8558 https://access.redhat.com/security/cve/CVE-2016-3710 https://access.redhat.com/security/cve/CVE-2016-3712 https://access.redhat.com/security/cve/CVE-2016-5105 https://access.redhat.com/security/cve/CVE-2016-5106 https://access.redhat.com/security/cve/CVE-2016-5107

1 0

[arch-security] [ASA-201606-7] firefox: multiple issues
by Levente Polyak 08 Jun '16

08 Jun '16

Arch Linux Security Advisory ASA-201606-7 ========================================= Severity: Critical Date : 2016-06-08 CVE-ID : CVE-2016-2815 CVE-2016-2818 CVE-2016-2819 CVE-2016-2821 CVE-2016-2822 CVE-2016-2825 CVE-2016-2828 CVE-2016-2829 CVE-2016-2831 CVE-2016-2832 CVE-2016-2833 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 47.0-1 is vulnerable to arbitrary code execution, same-origin policy bypass, information leakage, cross-site scripting, denial of service, clickjacking, addressbar spoofing and visual user confusion. Resolution ========== Upgrade to 47.0-1. # pacman -Syu "firefox>=47.0-1" The problems have been fixed upstream in version 47.0. Workaround ========== None. Description =========== - CVE-2016-2815 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2818 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2819 (arbitrary code execution) Security researcher firehack reported a buffer overflow when parsing HTML5 fragments in a foreign context such as under an <svg> node. This results in a potentially exploitable crash when inserting an HTML fragment into an existing document. - CVE-2016-2821 (arbitrary code execution) Security researcher firehack used the Address Sanitizer tool to discover a use-after-free in contenteditable mode. This occurs when deleting document object model (DOM) table elements created within the editor and results in a potentially exploitable crash. - CVE-2016-2822 (addressbar spoofing) Security researcher Jordi Chancel reported a method to spoof the contents of the addressbar. This uses a persistent menu within a <select> element, which acts as a container for HTML content and can be placed in an arbitrary location. When placed over the addressbar, this can mask the true site URL, allowing for spoofing by a malicious site. - CVE-2016-2825 (same-origin policy bypass) Security researcher Armin Razmdjou reported that the location.host property can be set to an arbitrary string after creating an invalid data: URI. This allows for a bypass of some same-origin policy protections. This issue is mitigated by the data: URI in use and any same-origin checks for http: or https: are still enforced correctly. As a result cookie stealing and other common same-origin bypass attacks are not possible. - CVE-2016-2828 (arbitrary code execution) Mozilla community member jomo reported a use-after-free crash when processing WebGL content. This issue was caused by the use of a texture after its recycle pool has been destroyed during WebGL operations, which frees the memory associated with the texture. This results in a potentially exploitable crash when the texture is later called. - CVE-2016-2829 (visual user confusion) Security researcher Tim McCormack reported that when a page requests a series of permissions in a short timespan, the resulting permission notifications can show the icon for the wrong permission request. This can lead to user confusion and inadvertent consent given when a user is prompted by web content to give permissions, such as for geolocation or microphone access. - CVE-2016-2831 (clickjacking) Security researcher sushi Anton Larsson reported that when paired fullscreen and pointerlock requests are done in combination with closing windows, a pointerlock can be created within a fullscreen window without user permission. This pointerlock cannot then be cancelled without terminating the browser, resulting in a persistent denial of service attack. This can also be used for spoofing and clickjacking attacks against the browser UI. - CVE-2016-2832 (information leakage) Mozilla developer John Schoenick reported that CSS pseudo-classes can be used by web content to leak information on plugins that are installed but disabled. This can be used for information disclosure through a fingerprinting attack that lists all of the plugins installed by a user on a system, even when they are disabled. - CVE-2016-2833 (cross-site scripting) Mozilla engineer Matt Wobensmith reported that Content Security Policy (CSP) does not block the loading of cross-domain Java applets when specified by policy. This is because the Java applet is loaded by the Java plugin, which then mediates all network requests without checking against CSP. This could allow a malicious site to manipulate content through a Java applet to bypass CSP protections, allowing for possible cross-site scripting (XSS) attacks. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same-origin policy, leak sensitive information, perform cross-site scripting, perform a denial of service attack, perform a clickjacking attack and spoof the addressbar via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-2815 https://access.redhat.com/security/cve/CVE-2016-2818 https://access.redhat.com/security/cve/CVE-2016-2819 https://access.redhat.com/security/cve/CVE-2016-2821 https://access.redhat.com/security/cve/CVE-2016-2822 https://access.redhat.com/security/cve/CVE-2016-2825 https://access.redhat.com/security/cve/CVE-2016-2828 https://access.redhat.com/security/cve/CVE-2016-2829 https://access.redhat.com/security/cve/CVE-2016-2831 https://access.redhat.com/security/cve/CVE-2016-2832 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2833 https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef…

1 0

[arch-security] [ASA-201606-6] subversion: multiple issues
by Levente Polyak 08 Jun '16

08 Jun '16

Arch Linux Security Advisory ASA-201606-6 ========================================= Severity: Medium Date : 2016-06-08 CVE-ID : CVE-2016-2167 CVE-2016-2168 Package : subversion Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package subversion before version 1.9.4-1 is vulnerable to authentication restriction bypass and denial of service. Resolution ========== Upgrade to 1.9.4-1. # pacman -Syu "subversion>=1.9.4-1" The problems have been fixed upstream in version 1.9.4. Workaround ========== None. Description =========== - CVE-2016-2167 (authentication restriction bypass) The canonicalize_username function in svnserve/cyrus_auth.c, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string. - CVE-2016-2168 (denial of service) The req_check_access function in the mod_authz_svn module in the httpd server allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check. Impact ====== A remote attacker is able to bypass authentication restrictions under certain circumstances by authenticating to an unexpected repository realm or perform a denial of service attack via a request with a specially crafted header. References ========== https://access.redhat.com/security/cve/CVE-2016-2167 https://access.redhat.com/security/cve/CVE-2016-2168 https://subversion.apache.org/security/CVE-2016-2167-advisory.txt https://subversion.apache.org/security/CVE-2016-2168-advisory.txt

1 0