July 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201607-14] libidn: denial of service
by Remi Gacogne 30 Jul '16

30 Jul '16

Arch Linux Security Advisory ASA-201607-14 ========================================== Severity: Low Date : 2016-07-30 CVE-ID : CVE-2015-8948 CVE-2016-6261 CVE-2016-6262 CVE-2016-6263 Package : libidn Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libidn before version 1.33-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.33-1. # pacman -Syu "libidn>=1.33-1" The problems have been fixed upstream in version 1.33. Workaround ========== None. Description =========== - CVE-2015-8948 (denial of service) Solve out-of-bounds-read when reading one zero byte as input. Also replaced fgets with getline. Reported by Hanno Boeck. - CVE-2016-6261 (denial of service) Fix out-of-bounds stack read in idna_to_ascii_4i. Reported by Hanno Boeck. - CVE-2016-6262 (denial of service) Really fix bug when reading \00 inputs. This issue results from an incomplete fix for CVE-2015-8948. - CVE-2016-6263 (denial of service) stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but now it doesn't crash when presented with such data. Reported by Hanno Boeck. Impact ====== A local attacker can crash an application using libidn or the idn program using a specially crafted input, leading to denial of service. References ========== http://www.openwall.com/lists/oss-security/2016/07/21/4 https://access.redhat.com/security/cve/CVE-2015-8948 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=570e68886c41c2e765e6… https://access.redhat.com/security/cve/CVE-2016-6261 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=f20ce1128fb7f4d33297… https://access.redhat.com/security/cve/CVE-2016-6262 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=5e3cb9c7b5bf0ce665b9… https://access.redhat.com/security/cve/CVE-2016-6263 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=1fbee57ef3c72db2206d…

1 0

[arch-security] [ASA-201607-13] imagemagick: information leakage
by Remi Gacogne 29 Jul '16

29 Jul '16

Arch Linux Security Advisory ASA-201607-13 ========================================== Severity: Low Date : 2016-07-29 CVE-ID : CVE-2016-6491 Package : imagemagick Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.5.3-1 is vulnerable to information leakage. Resolution ========== Upgrade to 6.9.5.3-1. # pacman -Syu "imagemagick>=6.9.5.3-1" The problem has been fixed upstream in version 6.9.5-3. Workaround ========== None. Description =========== An out-of-bounds read has been found in ImageMagick's Get8BIMProperty() function. This issue can lead to memory leak since the data read is written to the output image afterwards. Impact ====== A remote attacker can access sensitive information present in memory by submitting a crafted image file. References ========== http://git.imagemagick.org/repos/ImageMagick/commit/5cb6c1acd3e3b12f9260daf… http://seclists.org/oss-sec/2016/q3/194 https://access.redhat.com/security/cve/CVE-2016-6491

1 0

[arch-security] [ASA-201607-12] chromium: multiple issues
by Remi Gacogne 24 Jul '16

24 Jul '16

Arch Linux Security Advisory ASA-201607-12 ========================================== Severity: Critical Date : 2016-07-24 CVE-ID : CVE-2016-1705 CVE-2016-1706 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 52.0.2743.82-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 52.0.2743.82-1. # pacman -Syu "chromium>=52.0.2743.82-1" The problems have been fixed upstream in version 52.0.2743.82. Workaround ========== None. Description =========== - CVE-2016-1705 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. - CVE-2016-1706 (sandbox escape) Sandbox escape in PPAPI. Credit to Pinkie Pie. - CVE-2016-1708 (arbitrary code execution) Use-after-free in Extensions. Credit to Adam Varsan. - CVE-2016-1709 (arbitrary code execution) Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team. - CVE-2016-1710, CVE-2016-1711 (same-origin policy bypass) Same-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-5127 (arbitrary code execution) Use-after-free in Blink. Credit to cloudfuzzer. - CVE-2016-5128 (same-origin policy bypass) Same-origin bypass in V8. - CVE-2016-5129 (arbitrary code execution) Memory corruption in V8. Credit to Jeonghoon Shin. - CVE-2016-5130 (URL spoofing) URL spoofing. Credit to Wadih Matar. - CVE-2016-5131 (arbitrary code execution) Use-after-free in libxml. Credit to Nick Wellnhofer. - CVE-2016-5132 (same-origin policy bypass) Limited same-origin bypass in Service Workers. Credit to Ben Kelly. - CVE-2016-5133 (man-in-the-middle) Origin confusion in proxy authentication. Credit to Patch Eudor. - CVE-2016-5134 (information leakage) URL leakage via PAC script. Credit to Paul Stone. - CVE-2016-5135 (content security policy bypass) Content-Security-Policy bypass. Credit to ShenYeYinJiu of Tencent Security Response Center, TSRC. - CVE-2016-5136 (arbitrary code execution) Use after free in extensions. Credit to Rob Wu. - CVE-2016-5137 (information leakage) History sniffing with HSTS and CSP. Credit to Xiaoyin Liu. Impact ====== A remote attacker can access sensitive information, bypass policies or execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/07/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2016-1705 https://access.redhat.com/security/cve/CVE-2016-1706 https://access.redhat.com/security/cve/CVE-2016-1708 https://access.redhat.com/security/cve/CVE-2016-1709 https://access.redhat.com/security/cve/CVE-2016-1710 https://access.redhat.com/security/cve/CVE-2016-1711 https://access.redhat.com/security/cve/CVE-2016-5127 https://access.redhat.com/security/cve/CVE-2016-5128 https://access.redhat.com/security/cve/CVE-2016-5129 https://access.redhat.com/security/cve/CVE-2016-5130 https://access.redhat.com/security/cve/CVE-2016-5131 https://access.redhat.com/security/cve/CVE-2016-5132 https://access.redhat.com/security/cve/CVE-2016-5133 https://access.redhat.com/security/cve/CVE-2016-5134 https://access.redhat.com/security/cve/CVE-2016-5135 https://access.redhat.com/security/cve/CVE-2016-5136 https://access.redhat.com/security/cve/CVE-2016-5137

1 0

[arch-security] [ASA-201607-11] python2-django: cross-site scripting
by Jelle van der Waa 22 Jul '16

22 Jul '16

Arch Linux Security Advisory ASA-201607-11 ========================================== Severity: Medium Date : 2016-07-22 CVE-ID : CVE-2016-6186 Package : python2-django Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.8-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "python2-django>=1.9.8-1" The problem has been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== Unsafe usage of JavaScript's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn't identified there, out of an abundance of caution it's also updated to use textContent. Impact ====== An attacker is able to execute arbitrary javascript code in the client's browser by inserting code in the admin's add/change related popup. References ========== https://www.djangoproject.com/weblog/2016/jul/18/security-releases/ http://article.gmane.org/gmane.comp.python.django.announce/54 https://access.redhat.com/security/cve/CVE-2016-6186

1 0

[arch-security] [ASA-201607-10] python-django: cross-site scripting
by Jelle van der Waa 22 Jul '16

22 Jul '16

Arch Linux Security Advisory ASA-201607-10 ========================================== Severity: Medium Date : 2016-07-22 CVE-ID : CVE-2016-6186 Package : python-django Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.8-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "python-django>=1.9.8-1" The problem has been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== Unsafe usage of JavaScript's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn't identified there, out of an abundance of caution it's also updated to use textContent. Impact ====== An attacker is able to execute arbitrary javascript code in the client's browser by inserting code in the admin's add/change related popup. References ========== https://www.djangoproject.com/weblog/2016/jul/18/security-releases/ http://article.gmane.org/gmane.comp.python.django.announce/54 https://access.redhat.com/security/cve/CVE-2016-6186

1 0

[arch-security] [ASA-201607-9] drupal: proxy injection
by Christian Rebischke 22 Jul '16

22 Jul '16

Arch Linux Security Advisory ASA-201607-9 ========================================= Severity: High Date : 2016-07-21 CVE-ID : CVE-2016-5385 Package : drupal Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package drupal before version 8.1.7-1 is vulnerable to proxy injection via environment variable. Resolution ========== Upgrade to 8.1.7-1. # pacman -Syu "drupal>=8.1.7-1" The problem has been fixed upstream in version 8.1.7. Workaround ========== Apache (.htaccess) <IfModule mod_headers.c> RequestHeader unset Proxy </IfModule> NGINX/FastCGI fastcgi_param HTTP_PROXY ""; For any other service please visit: https://httpoxy.org/ Description =========== Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP requests. An attacker can provide a proxy server that Guzzle will use. This vulnerability is called 'httpoxy'. httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict: RFC 3875 (CGI) puts the HTTP Proxy header from a request into the environment variables as HTTP_PROXY HTTP_PROXY is a popular environment variable used to configure an outgoing proxy This leads to a remotely exploitable vulnerability. If you’re running PHP or CGI, you should block the Proxy header now. Impact ====== A remote attacker is able to proxy the outgoing HTTP requests made by the web application, direct the server to open outgoing connections to an address and port of their choosing or tie up server resources by forcing the vulnerable software to use a malicious proxy. References ========== https://access.redhat.com/security/cve/CVE-2016-5385 https://www.drupal.org/SA-CORE-2016-003 https://httpoxy.org/ https://bugzilla.redhat.com/show_bug.cgi?id=1353794

1 0

[arch-security] [ASA-201607-8] bind: denial of service
by Remi Gacogne 20 Jul '16

20 Jul '16

Arch Linux Security Advisory ASA-201607-8 ========================================= Severity: Medium Date : 2016-07-20 CVE-ID : CVE-2016-2775 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.4.P2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.4.P2-1. # pacman -Syu "bind>=9.10.4.P2-1" The problem has been fixed upstream in version 9.10.4.P2. Workaround ========== None. Description =========== Although not commonly used, the BIND package contains provisions to allow systems to resolve names using the lightweight resolver protocol, a protocol similar to (but distinct from) the normal DNS protocols. The lightweight resolver protocol can be used either by running the lwresd utility installed with BIND or by configuring named using the "lwres" statement in named.conf. An error has been discovered in the BIND implementation of the lightweight resolver protocol affecting systems which use this alternate method to do name resolution. A server which is affected by this defect will terminate with a segmentation fault error, resulting in a denial of service to client programs attempting to resolve names. Impact ====== A remote attacker can crash the server by sending a crafted request, causing a denial of service. References ========== https://kb.isc.org/article/AA-01393/74/CVE-2016-2775 https://access.redhat.com/security/cve/CVE-2016-2775

1 0

[arch-security] [ASA-201607-7] lib32-flashplugin: multiple issues
by Levente Polyak 18 Jul '16

18 Jul '16

Arch Linux Security Advisory ASA-201607-7 ========================================= Severity: Critical Date : 2016-07-18 CVE-ID : CVE-2016-4173 CVE-2016-4174 CVE-2016-4175 CVE-2016-4176 CVE-2016-4177 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4222 CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4232 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 CVE-2016-4247 CVE-2016-4248 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.632-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 11.2.202.632-1. # pacman -Syu "lib32-flashplugin>=11.2.202.632-1" The problems have been fixed upstream in version 11.2.202.632. Workaround ========== None. Description =========== - CVE-2016-4175 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by willJ of Tencent PC Manager, Sébastien Morin of COSIG, Yuki Chen of Qihoo 360 Vulcan Team, Wen Guanxing from Pangu LAB, and Jie Zeng of Tencent Zhanlu Lab. - CVE-2016-4247 (information disclosure) A race condition that could lead to information disclosure has been discovered. This vulnerability has been discovered by Stefan Kanthak. - CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 (arbitrary code execution) Three type confusion vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Ohara Rinne, Kurutsu Karen, and Garandou Sara working with Trend Micro's Zero Day Initiative. - CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4248 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by Nicolas Joly of Microsoft Vulnerability Research, Kai Kang (a.k.a 4B5F5F4B) working with Trend Micro's Zero Day Initiative, Jaehun Jeong(@n3sk) of WINS WSEC Analysis Team working with Trend Micro's Zero Day Initiative, and Natalie Silvanovich of Google Project Zero, and Wen Guanxing from Pangu LAB. - CVE-2016-4249 (arbitrary code execution) A heap buffer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered to Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4232 (memory leak) A memory leak vulnerability has been discovered. This vulnerability has been discovered by Natalie Silvanovich of Google Project Zero. - CVE-2016-4176 CVE-2016-4177 (arbitrary code execution) Two stack corruption vulnerabilities that could lead to arbitrary code execution have been found. These have been found by Francis Provencher of COSIG. - CVE-2016-4178 (information disclosure) A security bypass vulnerability that could lead to information disclosure has been discovered. These issues have been discovered by Soroush Dalili and Matthew Evans from NCC Group. Impact ====== A remote attacker can execute arbitrary code, crash the process, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-25.html https://access.redhat.com/security/cve/CVE-2016-4173 https://access.redhat.com/security/cve/CVE-2016-4174 https://access.redhat.com/security/cve/CVE-2016-4175 https://access.redhat.com/security/cve/CVE-2016-4176 https://access.redhat.com/security/cve/CVE-2016-4177 https://access.redhat.com/security/cve/CVE-2016-4179 https://access.redhat.com/security/cve/CVE-2016-4180 https://access.redhat.com/security/cve/CVE-2016-4181 https://access.redhat.com/security/cve/CVE-2016-4182 https://access.redhat.com/security/cve/CVE-2016-4183 https://access.redhat.com/security/cve/CVE-2016-4184 https://access.redhat.com/security/cve/CVE-2016-4185 https://access.redhat.com/security/cve/CVE-2016-4186 https://access.redhat.com/security/cve/CVE-2016-4187 https://access.redhat.com/security/cve/CVE-2016-4188 https://access.redhat.com/security/cve/CVE-2016-4189 https://access.redhat.com/security/cve/CVE-2016-4190 https://access.redhat.com/security/cve/CVE-2016-4217 https://access.redhat.com/security/cve/CVE-2016-4218 https://access.redhat.com/security/cve/CVE-2016-4219 https://access.redhat.com/security/cve/CVE-2016-4220 https://access.redhat.com/security/cve/CVE-2016-4221 https://access.redhat.com/security/cve/CVE-2016-4222 https://access.redhat.com/security/cve/CVE-2016-4223 https://access.redhat.com/security/cve/CVE-2016-4224 https://access.redhat.com/security/cve/CVE-2016-4225 https://access.redhat.com/security/cve/CVE-2016-4226 https://access.redhat.com/security/cve/CVE-2016-4227 https://access.redhat.com/security/cve/CVE-2016-4228 https://access.redhat.com/security/cve/CVE-2016-4229 https://access.redhat.com/security/cve/CVE-2016-4230 https://access.redhat.com/security/cve/CVE-2016-4231 https://access.redhat.com/security/cve/CVE-2016-4232 https://access.redhat.com/security/cve/CVE-2016-4233 https://access.redhat.com/security/cve/CVE-2016-4234 https://access.redhat.com/security/cve/CVE-2016-4235 https://access.redhat.com/security/cve/CVE-2016-4236 https://access.redhat.com/security/cve/CVE-2016-4237 https://access.redhat.com/security/cve/CVE-2016-4238 https://access.redhat.com/security/cve/CVE-2016-4239 https://access.redhat.com/security/cve/CVE-2016-4240 https://access.redhat.com/security/cve/CVE-2016-4241 https://access.redhat.com/security/cve/CVE-2016-4242 https://access.redhat.com/security/cve/CVE-2016-4243 https://access.redhat.com/security/cve/CVE-2016-4244 https://access.redhat.com/security/cve/CVE-2016-4245 https://access.redhat.com/security/cve/CVE-2016-4246 https://access.redhat.com/security/cve/CVE-2016-4247 https://access.redhat.com/security/cve/CVE-2016-4248

1 0

[arch-security] [ASA-201607-6] flashplugin: multiple issues
by Levente Polyak 18 Jul '16

18 Jul '16

Arch Linux Security Advisory ASA-201607-6 ========================================= Severity: Critical Date : 2016-07-18 CVE-ID : CVE-2016-4173 CVE-2016-4174 CVE-2016-4175 CVE-2016-4176 CVE-2016-4177 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4222 CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4232 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 CVE-2016-4247 CVE-2016-4248 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.632-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 11.2.202.632-1. # pacman -Syu "flashplugin>=11.2.202.632-1" The problems have been fixed upstream in version 11.2.202.632. Workaround ========== None. Description =========== - CVE-2016-4175 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by willJ of Tencent PC Manager, Sébastien Morin of COSIG, Yuki Chen of Qihoo 360 Vulcan Team, Wen Guanxing from Pangu LAB, and Jie Zeng of Tencent Zhanlu Lab. - CVE-2016-4247 (information disclosure) A race condition that could lead to information disclosure has been discovered. This vulnerability has been discovered by Stefan Kanthak. - CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 (arbitrary code execution) Three type confusion vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Ohara Rinne, Kurutsu Karen, and Garandou Sara working with Trend Micro's Zero Day Initiative. - CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4248 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by Nicolas Joly of Microsoft Vulnerability Research, Kai Kang (a.k.a 4B5F5F4B) working with Trend Micro's Zero Day Initiative, Jaehun Jeong(@n3sk) of WINS WSEC Analysis Team working with Trend Micro's Zero Day Initiative, and Natalie Silvanovich of Google Project Zero, and Wen Guanxing from Pangu LAB. - CVE-2016-4249 (arbitrary code execution) A heap buffer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered to Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4232 (memory leak) A memory leak vulnerability has been discovered. This vulnerability has been discovered by Natalie Silvanovich of Google Project Zero. - CVE-2016-4176 CVE-2016-4177 (arbitrary code execution) Two stack corruption vulnerabilities that could lead to arbitrary code execution have been found. These have been found by Francis Provencher of COSIG. - CVE-2016-4178 (information disclosure) A security bypass vulnerability that could lead to information disclosure has been discovered. These issues have been discovered by Soroush Dalili and Matthew Evans from NCC Group. Impact ====== A remote attacker can execute arbitrary code, crash the process, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-25.html https://access.redhat.com/security/cve/CVE-2016-4173 https://access.redhat.com/security/cve/CVE-2016-4174 https://access.redhat.com/security/cve/CVE-2016-4175 https://access.redhat.com/security/cve/CVE-2016-4176 https://access.redhat.com/security/cve/CVE-2016-4177 https://access.redhat.com/security/cve/CVE-2016-4179 https://access.redhat.com/security/cve/CVE-2016-4180 https://access.redhat.com/security/cve/CVE-2016-4181 https://access.redhat.com/security/cve/CVE-2016-4182 https://access.redhat.com/security/cve/CVE-2016-4183 https://access.redhat.com/security/cve/CVE-2016-4184 https://access.redhat.com/security/cve/CVE-2016-4185 https://access.redhat.com/security/cve/CVE-2016-4186 https://access.redhat.com/security/cve/CVE-2016-4187 https://access.redhat.com/security/cve/CVE-2016-4188 https://access.redhat.com/security/cve/CVE-2016-4189 https://access.redhat.com/security/cve/CVE-2016-4190 https://access.redhat.com/security/cve/CVE-2016-4217 https://access.redhat.com/security/cve/CVE-2016-4218 https://access.redhat.com/security/cve/CVE-2016-4219 https://access.redhat.com/security/cve/CVE-2016-4220 https://access.redhat.com/security/cve/CVE-2016-4221 https://access.redhat.com/security/cve/CVE-2016-4222 https://access.redhat.com/security/cve/CVE-2016-4223 https://access.redhat.com/security/cve/CVE-2016-4224 https://access.redhat.com/security/cve/CVE-2016-4225 https://access.redhat.com/security/cve/CVE-2016-4226 https://access.redhat.com/security/cve/CVE-2016-4227 https://access.redhat.com/security/cve/CVE-2016-4228 https://access.redhat.com/security/cve/CVE-2016-4229 https://access.redhat.com/security/cve/CVE-2016-4230 https://access.redhat.com/security/cve/CVE-2016-4231 https://access.redhat.com/security/cve/CVE-2016-4232 https://access.redhat.com/security/cve/CVE-2016-4233 https://access.redhat.com/security/cve/CVE-2016-4234 https://access.redhat.com/security/cve/CVE-2016-4235 https://access.redhat.com/security/cve/CVE-2016-4236 https://access.redhat.com/security/cve/CVE-2016-4237 https://access.redhat.com/security/cve/CVE-2016-4238 https://access.redhat.com/security/cve/CVE-2016-4239 https://access.redhat.com/security/cve/CVE-2016-4240 https://access.redhat.com/security/cve/CVE-2016-4241 https://access.redhat.com/security/cve/CVE-2016-4242 https://access.redhat.com/security/cve/CVE-2016-4243 https://access.redhat.com/security/cve/CVE-2016-4244 https://access.redhat.com/security/cve/CVE-2016-4245 https://access.redhat.com/security/cve/CVE-2016-4246 https://access.redhat.com/security/cve/CVE-2016-4247 https://access.redhat.com/security/cve/CVE-2016-4248

1 0

[arch-security] [ASA-201607-5] gimp: arbitrary code execution
by Christian Rebischke 18 Jul '16

18 Jul '16

Arch Linux Security Advisory ASA-201607-5 ========================================= Severity: Medium Date : 2016-07-17 CVE-ID : CVE-2016-4994 Package : gimp Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gimp before version 2.8.18-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.8.18-1. # pacman -Syu "gimp>=2.8.18-1" The problem has been fixed upstream in version 2.8.18. Workaround ========== None. Description =========== Multiple Use-After-Free when parsing XCF channel and layer properties. Impact ====== An attacker is able to use a specially crafted XCF file, that when opened locally, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-4994 https://bugzilla.gnome.org/show_bug.cgi?id=767873

1 0